Concepts

Idempotent requests

Retry POSTs safely with Idempotency-Key.

Every POST needs an Idempotency-Key header: any unique string of 1 to 255 visible characters, for example a UUID. If the network fails and you are not sure the request arrived, send it again with the same key.

• The first request is processed. Retries with the same key and the same body return the first response, with the header Idempotent-Replayed: true, for 24 hours.
• The same key with a different body returns idempotency_key_reused.
• A retry while the first request is still running returns idempotency_in_progress; wait and try again.
• A response that contained a secret shown only once (a new token) is not replayed: replay_unavailable.
• No key at all returns idempotency_key_required.

curl -X POST https://api.storelyne.com/admin/2026-11/apps \
  -H "Authorization: Bearer pat_live_..." \
  -H "Idempotency-Key: 6f1c8a52-3f0e-4b8e-9d0a-1b2c3d4e5f60" \
  -H "Content-Type: application/json" \
  -d '{"name":"ERP sync","scopes":["read_products"]}'

Our JavaScript SDK adds a key to every POST and reuses it when it retries.