A double-clicked release button without an idempotency key pays a seller twice

Every mutating Stripe call carries an idempotency key hashed from its own params -- without it, a double-clicked release creates two transfers and the seller is paid twice (D16).

This is one of the things Marketplace Payouts & Connected Accounts already handles. Take payment from buyers and pay out sellers, with the onboarding and identity checks Stripe requires.

Buy for $1993 of 3 clean-room builds passed · full refund if it fails on your machine

Is this you?

A release-funds button that's clicked twice in quick succession -- a slow network response, an impatient operator, a retried request after a timeout -- can trigger transfers.create twice for the same order if nothing prevents it, moving the seller's net payout out to their connected account two times over for a single sale.

Why this one is easy to get wrong

The release endpoint's own application-level checks (is the order HELD, has the hold elapsed) all still pass on the second, redundant click, because from the database's point of view at the moment each request runs, nothing yet marks the order as already released -- the race is between two requests, not between a request and a validation rule.

What you get instead

Every mutating Stripe call in the pack passes an idempotencyKey built from a short hash of its own parameters -- ops pi, xfer, refund, rev, acct, link -- so an identical retry (the double click) dedupes to the same server-side result, while a genuinely changed request still gets a fresh key rather than hitting an idempotency_error. Keys expire server-side after 24 hours, and maxNetworkRetries: 2 on the client covers transient network-level duplicates on top of that.

Source: ARCHITECTURE.md D16 — checkable in the pack you receive

How you actually use this

You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.

Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.

Typical build: about 25 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.

Why you can believe this

3 of 3 runs passed

We ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →

Buy for $199 14-day refund if verify.sh fails →