ArchitectAI resilience reviews are here. See what's new
Back to all articles
High Level Design Oct 10, 2026 15 min read

Designing Stripe: Payment Gateway Architecture & Zero-Loss Idempotency

Architecture secrets of mission-critical payment gateways: Distributed idempotency layers, double-entry general ledgers, and zero-loss webhook delivery.

HLDFintechIdempotencyPaymentsPostgreSQL
HFHLDForge Architecture TeamStaff Fintech Architect

1. The High Stakes of Financial Systems

In payment processing, eventual consistency is unacceptable. If an HTTP request times out due to transient network failure, retrying must never charge the customer twice. A payment gateway must guarantee exactly-once business semantics despite at-least-once network protocols.

  • Availability SLA: 99.999% (Five Nines)
  • Double-Charge Tolerance: Exactly 0%
  • Latency: p99 < 800ms including card network authorization
  • Compliance: Strict PCI-DSS Level 1 tokenization

2. Idempotency Layer Architecture

Every payment API request requires an `Idempotency-Key` header generated by the client (e.g. UUIDv4). When the gateway receives the request, it executes an atomic operation in an Idempotency Store (Redis or PostgreSQL).

If the key is new, an `IN_PROGRESS` record is stored with a 24-hour TTL and distributed lock. If a duplicate request arrives while processing, the second request waits on the lock or receives a 409 Conflict. Once complete, the exact response payload is cached and returned for all future retries with the same key.

3. Double-Entry Accounting Ledger

Financial balances are never stored as a mutable integer column (`balance = balance + 50`). Instead, every transaction is recorded as an immutable pair of debit and credit entries in an append-only ledger.

Total debits must equal total credits at all times. This mathematical invariant ensures that funds cannot vanish or appear out of thin air, providing complete auditability.

4. Webhook Delivery & Dead-Letter Queuing

Merchants rely on webhooks to unlock digital goods when a charge succeeds. The webhook engine uses an event-driven architecture with exponential backoff retries (1m, 5m, 1h, 6h, 24h) and cryptographic HMAC-SHA256 signatures to guarantee authenticity.

Interactive Modeling ArchitectAI

Model this architecture on the HLDForge Canvas

Turn static box diagrams into living, collaborative systems. Drag and drop microservices, Kafka clusters, and cache tiers. Run automated SPOF detection and STRIDE threat modeling in real time.

HF

Written by HLDForge Architecture Team

Staff Fintech Architect

The HLDForge Architecture Team publishes practical engineering guides, real-world case studies, and high-concurrency blueprints to help engineers build scalable and fault-tolerant software.

Free forever plan

Ready to master distributed system design?

HLDForge gives you the tools, templates, and AI reviews to design systems like a Staff Engineer. Get started free.

SOC 2 Type II · ISO 27001 aligned · SSO on every paid plan