A retry should replace a submission, not add a second one.

The duplicate is made by the client, not the server

Almost every duplicate submission is a retry that was never recognised as a retry. A phone loses signal mid-request, the browser retries, and both attempts reach the endpoint. Someone double clicks a slow button. A visitor presses back after a redirect and sends the form again. From the server's side those are three separate, valid submissions, because nothing in the payload distinguishes them.

An idempotency key is the smallest possible fix: a string that says "this request is the same intent as the one before it".

// Generate once, when the form is rendered — not inside a retry loop.
const intentKey = crypto.randomUUID();

async function send(payload) {
  const response = await fetch("https://freelyform.com/f/FORM_ID", {
    method: "POST",
    headers: { "Content-Type": "application/json", "Idempotency-Key": intentKey },
    body: JSON.stringify(payload),
  });
  return response.json();
}

What the key is scoped to

A key is unique inside one form. The same string used on a different form is a different submission, which is convenient: a client can reuse one identifier scheme across every form without cross-talk. It also means a key that looks reused is only a problem when it is reused within the same form.

Two requests at once

The deduplication is enforced by uniqueness rather than by a lock, so a genuinely simultaneous double submit behaves sanely: one request writes the record and the other reads it back and returns it. There is no window where both succeed and two records appear.

What it does not fix

• Retries with a new key. Generating the key inside the retry handler is the most common mistake; each attempt then looks like a new intent.
• Two people sending the same content. That is not a duplicate, and no key should remove it.
• A form that clears itself after failure. The visitor retypes and resends with a new intent, which is a new submission — correctly so.

When it is worth the six lines

Any form whose submission has a cost to the person receiving it: an order request, a quote, a support ticket, an application. On a marketing page where the loss of one duplicate is invisible, skip it. On a form where a duplicate means someone processes an order twice, it is the cheapest reliability you will add all week.