Learn the concept
Authentication establishes who is making a request; authorization determines what that identity may access. A token supplied by a client is not trustworthy until validated by the appropriate system. Do not invent a custom production authentication scheme for a learning project.
Load credentials from secure server configuration and scope them to the required service. Avoid printing tokens in logs or committing them to source control. For tests, use clearly synthetic identifiers and inject an already-validated actor into domain logic.
Retry only failures that may recover, within a bounded time budget. Mutations need an idempotency or reconciliation strategy because a timeout can occur after the remote action completes. An idempotency key is useful only if the receiving system stores and enforces its meaning.
Run and inspect
results = {}
def create_once(operation_id, value):
if operation_id in results:
if results[operation_id] != value: raise ValueError("Conflicting replay")
return results[operation_id]
results[operation_id] = value
return value
assert create_once("op-1", "ticket") == "ticket"
assert create_once("op-1", "ticket") == "ticket"
assert len(results) == 1
Your exercise
Test a repeated operation ID with the same payload and with a different payload. Explain why the in-memory example is insufficient across restarts or multiple servers.
Check your understanding
Replays are deterministic, conflicting reuse is rejected, and the limitations of the teaching example are explicit.