When a key is needed

Operation	Idempotency-Key
`POST /bookings`	required
`POST /bookings/{id}/cancel`	required
`PATCH` requests	optional, recommended
`GET`, `POST /quotes`	not needed (no side effects)

curl

curl -X POST https://app.staystryk.com/api/partner/v1/bookings \
  -H "Authorization: Bearer $STRYK_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: web-checkout-7f3a9c21" \
  --data @booking.json

Rules

A key has 1 to 160 characters from A-Z a-z 0-9 . _ : -. A UUID v4 is a good choice.
STRYK stores the key with the request and its result for 24 hours, per API key.
Same key and same body: you receive the stored result of the first request, with the same status code. Nothing is executed twice.
Same key, different body: 422 idempotency_key_reused.
First request still running: 409 idempotency_in_progress. Wait briefly and retry.
Missing key where required: 400 idempotency_key_required.

In practice

Create the key before the first attempt and store it with your own record (checkout, order, sync job). A key generated anew for each retry protects nothing.
When the request itself changes, the guest confirms a new price, use a new key.
For cancellations, a key derived from the booking ID (cancel-<id>) turns double clicks into one cancellation.