A Key the Server Remembers, So a Repeat Doesn't Repeat the Effect
POST isn't idempotent on its own. Sending the same POST twice usually creates two resources.
An idempotency key fixes this. The client creates a unique key and attaches it to the request. The server stores the result of the first request it sees with that key. When the same key arrives again, the server returns the stored result instead of processing the request a second time.
A client may retry after a timeout, and the network may duplicate a request. Because the server remembers the key, the client's intent of "this one attempt" is kept across retries, and a repetition that wasn't safe becomes safe.
Explain how an idempotency key prevents a duplicate POST from creating a resource twice, and what the server does when it sees a key it's already processed.
A client sends POST /orders with Idempotency-Key: "abc", times out waiting for a response, and retries with the exact same key. The first request actually succeeded on the server. What happens?