How do I prevent duplicate payments and double bookings?

These are business-logic races, and they need server-side defences:

• Idempotency keys — a unique (user, key) constraint using INSERT … ON CONFLICT, never check-then-insert
• Atomic reservation — reserve inventory and create the booking in one transaction, with a unique/exclusion constraint so the same unit or time slot cannot be taken twice
• Webhook safety — verify signatures, enforce a replay window and process each event ID once
• Ledger + reconciliation — an immutable record of money movement, reconciled against the provider
• Locks held briefly — never keep a database transaction open while calling an external API
• Tests for double-submit, concurrent updates and partial failure
• Audit trail for every payout, refund and approval

Queues deliver at least once, so payment and payroll consumers must never assume exactly-once processing.