How and based on what is the idempotency key calculated which the clients sends with its request? In my double-purchase example above: when would the second purchase be requested with the same key or not?
It shouldn't, an error would be the right response.
If it’s a retry of the same request it should have the same key. If it’s not a retry, a different one. I don’t see the issue.
If the client sends the same key but a different payload that’s a 400 or 409 in my eyes.