Stripe Engineering Blog

Ideas you will meet

Payments

Idempotency, ledgers and reliable money movement.

Idempotency

Making retries safe so duplicates do no harm.

What we already know about this

Our own lessons on these ideas. Read them here before you start, so it makes sense.

• Core Concepts: How Things Actually Work · 8 minWhere online payments are headingInstant payments, open banking, wallets and tokens, stronger authentication and new money types: what is changing and what it means for system design.Read hereClose

  Why this matters to a system designer

  Payment systems are changing from card-centric, batch and slow, to real-time, account-based and programmable. Each trend changes your architecture, so it helps to know the direction. The items below describe trends in the industry, not predictions about any one product.

  Trend 1: instant, always-on payments

  Many countries now run instant payment schemes: UPI (India), Pix (Brazil), Faster Payments (UK), SEPA Instant (Europe), FedNow (United States). Funds move between bank accounts in seconds, at any hour, including weekends.

  Design consequences:

  • Settlement is final and fast, so fraud checks must happen in real time, before sending.
  • Your system must run 24/7 with no overnight batch window.
  • Confirmation arrives asynchronously, so you need pending states, webhooks and reconciliation (see the payment design lesson).

  Trend 2: open banking and account-to-account payments

  Regulations such as the EU's PSD2 and similar rules elsewhere require banks to offer APIs so that, with the customer's consent, a regulated third party can see account data or initiate a payment directly from the bank account. This enables card-free checkout at lower cost.

  Design consequences: you integrate with consent flows and bank-specific quirks, handle redirects and expiring consents, and treat the bank as an unreliable dependency.

  Trend 3: wallets, network tokens and tokenisation

  Apple Pay, Google Pay and similar wallets store a token instead of the card number. Card networks also issue network tokens for saved cards that can be refreshed when a card is reissued. A stolen token is of little use elsewhere.

  Design consequences: store tokens, not card numbers; handle lifecycle updates (card replaced, token suspended); and rely on the provider's PCI-compliant fields.

  Trend 4: stronger authentication and less fraud

  Strong customer authentication (for example 3-D Secure 2) adds a risk-based extra check only when needed. Passkeys and device biometrics replace passwords and one-time codes. Machine learning scores transactions in milliseconds using device, behaviour and network signals.

  Design consequences: payment flows need extra steps and failure handling, and a risk engine on the critical path with tight latency budgets.

  Trend 5: embedded finance and flexible credit

  Payments are built into other products (marketplaces, software platforms, ride apps), and pay later options split a purchase into instalments. Platforms handle onboarding of sellers, split payouts and compliance.

  Design consequences: multi-party ledgers, payouts, KYC and risk for sub-merchants, and refunds that touch several accounts.

  Trend 6: richer messages and faster cross-border

  The ISO 20022 standard brings structured, data-rich payment messages to banks worldwide, improving reconciliation and screening. Cross-border networks are working to shorten the chain of intermediaries and improve tracking (see the cross-border lesson).

  Trend 7: new forms of money

  Stablecoins and central bank digital currencies (CBDCs) are being explored, piloted or regulated in different places. Treat them as additional payment rails with their own settlement, custody and regulatory models, not a replacement for the fundamentals.

  A ledger-based wallet on a blockchain keeps balances as shared, append-only records that many parties verify, which can shorten settlement. The trade-offs are throughput, finality rules, regulation and the loss of simple reversal, so treat it as another rail with its own failure modes, not a replacement for the ledger discipline above.

  The payment rails side by side

  100%

  Figure SDA-CORE-21-1 · Several rails into one payment service · © forcsguy.com

  What stays the same

  Whatever the rail, the engineering core is stable: idempotency, a double-entry ledger, a clear state machine, asynchronous confirmation, reconciliation, strong security, and observability. Build those well, and adding a new payment method becomes an integration, not a rewrite.

  Real-world reading

  Related reading

  • Stripe's payments APIs: the first 10 yearsStripeCase Studies
  • Stripe Engineering BlogStripe engineers · StripeBlogs
  • Square BlogBlock (Square) engineers · Block (Square)Blogs
  • Klarna BlogKlarna engineers · KlarnaBlogs

  Show 6 moreShow fewer

  • Coinbase BlogCoinbase engineers · CoinbaseBlogs
  • Nubank BlogNubank engineers · NubankBlogs
  • Kraken BlogKraken engineers · KrakenBlogs
  • Capital One BlogCapital One engineers · Capital OneBlogs
  • Automated Fake Account Detection at LinkedInLinkedIn engineers · LinkedInCase Studies
  • Squarespace Engineering BlogSquarespace engineers · SquarespaceBlogs

  Open this lesson with its quiz and exercise

• Core Concepts: How Things Actually Work · 9 minHow online payments workThe parties involved, why idempotency is essential, and how a ledger and reconciliation keep money correct.Read hereClose

  The players

  A card payment involves several parties:

  • Customer and their issuing bank (which holds the account).
  • Merchant and their acquiring bank.
  • A card network (such as Visa or Mastercard) connecting banks.
  • A payment service provider (PSP) that handles the complexity for merchants.

  Most businesses do not touch card numbers: they use a PSP's hosted form or tokens, which shrinks security and compliance scope (PCI DSS).

  Image: Syced · CC0 · Source · Wikimedia Commons: LaCuCa card reader - payment terminal at supermarket register

  A typical flow

  100%

  Figure SDA-CORE-15-1 · A typical flow · © forcsguy.com

  Steps are usually authorise (reserve funds) then capture (take the money), then settlement between banks days later.

  Idempotency

  Networks time out, users double-click, services retry. Without protection, a retry can charge twice. Solve it with an idempotency key: a unique value per intended payment, sent with the request. The server stores the result under that key, and any repeat returns the stored result instead of acting again.

  Model the money as a ledger

  Never just update a balance field. Record every movement as entries in an append-only ledger using double-entry bookkeeping: each transaction has a debit and an equal credit.

  • Balances are computed from entries, and always sum to zero across the system, so errors stand out.
  • You get a full audit trail.
  • Use integer minor units (cents), never floating point, for amounts, and store the currency.

  State machines and asynchronous reality

  A payment moves through states: created, pending, authorised, captured, failed, refunded. Make transitions explicit and allow only valid ones. Many results arrive asynchronously by webhook, so your system must accept webhooks idempotently, verify their signatures, and tolerate them arriving late or out of order.

  Reconciliation

  Your records, the provider's and the bank's will occasionally disagree (a timeout hid a success, a webhook was lost). A scheduled reconciliation job compares them, flags mismatches and drives them to a resolution. Treat unexplained differences as incidents.

  Reliability and security

  • Keep the write path simple and durable; do slow work (emails, analytics) asynchronously.
  • Use strong consistency for balances and payment state.
  • Protect against fraud with limits, velocity checks and risk scoring.
  • Never log card data or secrets; use tokenisation and encryption.

  Real-world reading

  Related reading

  • Designing robust and predictable APIs with idempotencyBrandur Leach · StripeBlogs
  • 10 Tips for Building Resilient Payment SystemsShopify Engineering · ShopifyCase Studies
  • Stripe Engineering BlogStripe engineers · StripeBlogs
  • Making retries safe with idempotent APIsAmazon Builders' Library · Amazon Web ServicesBlogs

  Show 6 moreShow fewer

  • Stripe's payments APIs: the first 10 yearsStripeCase Studies
  • Klarna BlogKlarna engineers · KlarnaBlogs
  • Square BlogBlock (Square) engineers · Block (Square)Blogs
  • Coinbase BlogCoinbase engineers · CoinbaseBlogs
  • Asana Engineering BlogAsana engineers · AsanaBlogs
  • Auth0 Engineering BlogAuth0 engineers · Auth0Blogs

  Open this lesson with its quiz and exercise

• Real-World Systems · 9 minCross-border payments: SWIFT and foreign exchangeHow money moves between countries and currencies, what SWIFT actually is, and why international transfers are slow and costly.Read hereClose

  The problem

  Paying someone across borders or currencies is harder than paying next door. Different banks, rules, currencies and time zones are involved, and there is no single global bank.

  Messages versus money

  Two things happen and they are often confused:

  • Messaging: telling the other bank what to do. SWIFT (the Society for Worldwide Interbank Financial Telecommunication) is a secure messaging network with standard message formats. It does not hold or move money.
  • Settlement: actually moving the value, by adjusting balances in accounts that banks hold with each other, or at a central bank.

  100%

  Figure SDA-RWS-08-1 · A payment message crossing a messaging network · © forcsguy.com

  Correspondent banking

  If your bank has no direct relationship with the recipient's bank, it uses correspondent banks. Banks hold accounts with each other:

  • A nostro account: "our money held at your bank, in your currency".
  • A vostro account: the mirror view, "your money held at our bank".

  100%

  Figure SDA-RWS-08-2 · Correspondent banking chain · © forcsguy.com

  Each additional hop can add fees, delay, and a chance of error or manual review, and the sender often cannot see where the payment is.

  Foreign exchange

  Paying in another currency needs currency conversion:

  • Rates come from the FX market (banks and liquidity providers). A provider quotes you a rate that includes a spread (their margin) over the market rate.
  • A quote can be locked for a short time, since rates move constantly, so the system must record the quoted rate and its expiry.
  • The cost of a transfer is fees plus spread, so a "free" transfer may still be expensive.
  • Hedging and netting (offsetting payments in opposite directions) reduce a provider's risk and cost.

  100%

  Figure SDA-RWS-08-3 · A currency conversion inside a transfer · © forcsguy.com

  The layers of the currency market

  Behind a single conversion sit three layers. A payment company's own funding pool serves retail needs and is usually topped up in advance. When the pool runs low it trades with wholesale providers, who batch many such orders. Those wholesalers in turn trade with the large international banks at the top. Pre-buying currency in bulk is why a customer's conversion can feel instant even though the settlement happens later.

  Compliance

  Cross-border payments pass sanctions screening, anti-money-laundering (AML) monitoring and know-your-customer (KYC) checks. Suspicious payments are held for manual review, which causes much of the delay. A design must keep full audit trails and be able to stop and explain any payment.

  Faster alternatives

  • Local payment rails (for example SEPA in Europe, Faster Payments in the UK, UPI in India, Pix in Brazil) are cheap and quick domestically. Some services pre-fund local accounts in each country, so a transfer becomes two local payments with the FX done in between, without moving money across borders each time.
  • Instant, standards-based schemes and new interbank initiatives aim to shorten the chain and improve tracking.
  • Some systems use stablecoins or other digital rails for settlement, with their own regulatory and operational risks.

  Designing a system that sends money abroad

  • Treat each transfer as a long-running workflow with states (quoted, submitted, in review, settled, failed, returned).
  • Store the quote (rate, fees, expiry) and show the customer the total up front.
  • Use idempotency keys and a ledger (previous lesson), with separate accounts per currency.
  • Handle returns and rejections: money can come back days later, and the workflow must refund and notify correctly.
  • Reconcile with every partner bank or provider daily, in each currency.

  Real-world reading

  Related reading

  • Nubank BlogNubank engineers · NubankBlogs
  • Klarna BlogKlarna engineers · KlarnaBlogs
  • Coinbase BlogCoinbase engineers · CoinbaseBlogs
  • Kraken BlogKraken engineers · KrakenBlogs

  Show 6 moreShow fewer

  • Capital One BlogCapital One engineers · Capital OneBlogs
  • Stripe Engineering BlogStripe engineers · StripeBlogs
  • Monzo: How Peer-To-Peer Payments WorkMonzo engineers · MonzoBlogs
  • Architectures of Finance, Banking, and Payment SystemsRedhat engineers · RedhatCase Studies
  • Google Cloud BlogGoogle Cloud engineers · Google CloudBlogs
  • Algolia Engineering BlogAlgolia engineers · AlgoliaBlogs

  Open this lesson with its quiz and exercise