Idempotency is enforced in the database
Checking for a duplicate in application code leaves a race between two concurrent retries. A unique constraint on the merchant and idempotency_key makes the second insert fail, and the handler returns the original transaction instead. That turns a double charge from a bug that is hard to reproduce into an outcome the database makes impossible.