Wallet payment flows see more client retries than card-not-present ecommerce. Users leave the app mid-3DS, networks drop in the MTR, and push notifications invite a second attempt.
An authorization path review checks whether idempotency keys are generated at the right layer, expire safely, and survive device switches. Keys that live only in the client session break when the user opens another phone.
We also look at how declines are keyed. Soft-decline retries that reuse a spent key can silently skip a legitimate second attempt — or worse, duplicate a capture.
Document the key lifecycle next to your flow map. Partners and auditors ask for it; your on-call engineers need it more.