Authentication and tokensintermediate
A JWT is a signed note saying who the caller is; issuing one, refreshing it before it expires, and never storing a password in plain text are the three things every API has to get right.
An endpoint that marks an order paid because the browser said so.
The endpoint believes only Paystack, checks amount, currency and ownership, and fulfils once.
Published in full, before you start — every point is one of these and there is nothing else.
A JWT is a signed note saying who the caller is; issuing one, refreshing it before it expires, and never storing a password in plain text are the three things every API has to get right.
A raw exception string tells the caller nothing they can act on; RFC 7807 ProblemDetails gives every failure the same machine-readable shape.
A request that times out has not necessarily failed — you just did not hear back — so the client retries, and unless the write recognises that it has already happened the customer is charged twice.