Trace a checkout request through the payment stack

Follow one request from the storefront to the ledger, with the code and the conversations that explain each hop.

Current with its sourcescheckout-api@a41f2c9 · payments-worker@7d0b114

OrbitPay demo data. Connect your sources to generate this from your own repositories, Slack, and Linear.

Step 1 of 6

The request arrives and returns before anything is charged

Test me

Evidence

Everything this step is built from

Code

checkout-api · src/routes/checkout.ts

96%

router.post('/checkout', withIdempotency, async (req, res) => {
  const intent = await payments.createIntent(req.body, {
    idempotencyKey: req.idempotencyKey,
  });
  await queue.enqueue('payment.authorize', { intentId: intent.id });
  res.status(202).json({ intentId: intent.id, status: 'processing' });
});

dev-shahMay 14, 2026Open source

Code

checkout-api · src/payments/idempotency.ts

93%

// Keys live for 24h. Anything replayed after that window creates a second
// intent, which is exactly how PAY-209 produced duplicate charges.
export const IDEMPOTENCY_TTL_SECONDS = 60 * 60 * 24;

priya-ramanApr 8, 2026Open source

Linear

PAY-209 · Duplicate payment events after idempotency expiry

95%

Two merchants were charged twice when a client replayed a checkout request after the 24-hour idempotency window. Mitigated by alerting on duplicate intents; the underlying dedupe gap is still open.

Priya RamanApr 8, 2026Open source

Hover any claim to see its source type, title, timestamp, and confidence without leaving the sentence.

Onboard

OrbitPayLearner

Explore

Architecture walkthrough

Trace a checkout request through the payment stack

Follow one request from the storefront to the ledger, with the code and the conversations that explain each hop.

Current with its sourcescheckout-api@a41f2c9 · payments-worker@7d0b114

OrbitPay demo data. Connect your sources to generate this from your own repositories, Slack, and Linear.

Step 1 of 6

The request arrives and returns before anything is charged

Test me

Evidence

Everything this step is built from

Code

checkout-api · src/routes/checkout.ts

96%

router.post('/checkout', withIdempotency, async (req, res) => {
  const intent = await payments.createIntent(req.body, {
    idempotencyKey: req.idempotencyKey,
  });
  await queue.enqueue('payment.authorize', { intentId: intent.id });
  res.status(202).json({ intentId: intent.id, status: 'processing' });
});

dev-shahMay 14, 2026Open source

Code

checkout-api · src/payments/idempotency.ts

93%

// Keys live for 24h. Anything replayed after that window creates a second
// intent, which is exactly how PAY-209 produced duplicate charges.
export const IDEMPOTENCY_TTL_SECONDS = 60 * 60 * 24;

priya-ramanApr 8, 2026Open source

Linear

PAY-209 · Duplicate payment events after idempotency expiry

95%

Two merchants were charged twice when a client replayed a checkout request after the 24-hour idempotency window. Mitigated by alerting on duplicate intents; the underlying dedupe gap is still open.

Priya RamanApr 8, 2026Open source

Hover any claim to see its source type, title, timestamp, and confidence without leaving the sentence.