Idempotency is not a key, it's a contract

Adding an Idempotency-Key header is the easy part. The contract is what counts as the same request, how long the promise lasts, what a retry gets while the first attempt is still running, and which failures are worth remembering.