What you get: no customers charged twice, no duplicate records, no “how did this happen?” calls to support.
The rule: every operation with side effects (creating a record, charging, sending an email, requesting a signature) takes an Idempotency-Key. The server claims the key atomically, stores the request hash with the final response, and returns that same response on every repeat. Same key with a different body: 409. Networks and clients retry; that is not a fault, it is reality. With this rule, a retry turns from a source of bugs into a safety mechanism.