Also, I like the idea of using an idempotent key, since we don't have the single-use guarantee that comes with a token generated by Stripe.js. Are you passing your idempotency key through the user's browser via the payment form and back into your controller? Not sure how to set this up exactly but I think it would help alleviate accidental double clicks along with any network hiccups