Idempotent metered billing without tears
Idempotent metered billing lets you bill a million API calls a day without ever double-charging one. Here's how RIIP makes every charge safe to retry — with a single money path, append-only ledger, and no negative balances.
Idempotent metered billing means every charge is safe to retry: submit the same billable event twice and the customer is charged once. At the scale of a million metered API calls a day, this is not a nicety — it is the difference between a trustworthy invoice and a support queue full of double-charge complaints. Here is the shape of a billing system that never double-charges.
Idempotency keys on every money event
Each billable event carries a stable idempotency key derived from what it represents, not when it arrived. The first time we see a key, we record the charge; every subsequent time, we return the original result without charging again. Networks retry, clients retry, queues redeliver — the key makes all of that harmless.
One money path, an append-only ledger
- →A single code path performs every balance change, so there is exactly one place where money moves and one place to audit.
- →The ledger is append-only — charges and credits are entries, never edits — so the full history is reconstructable and reconciliation is exact.
- →Balances are clamped to never go negative, under a row lock, so concurrent debits can't race a balance below zero.
- →Principal and credit funds are kept distinct so a refund or reversal can never quietly mix them.
Why it matters to customers
The customer-visible result is boring in the best way: every charge is itemized, every response carries a credits_used field, and the invoice always reconciles against usage. Overage is billed per 1,000 calls at a published rate with no hard cutoff, so an integration keeps working past its included quota instead of failing at the worst moment.
The goal of a billing system is to be invisible. You notice it only when it's wrong — so we built it so it can't be.
None of this is exotic. It is idempotency keys, a single money path, an append-only ledger, and non-negative balances applied without exception. The discipline is in the 'without exception' part.