What is an idempotency key for on a payout, and what happens if I reuse one?

That is exactly the situation idempotency keys exist for, and it is the single most valuable habit on a money-out endpoint.

Send an Idempotency-Key header with a value you generated, one per logical payout. A uuid per payout row in your own database works well, because it survives your process restarting.

What then happens:

• first request with that key does the work and the result is stored against it
• any later request with the same key returns that same stored result rather than doing the work again

So a retry after a timeout is safe. You either get the original outcome back, or the original request never landed and the retry becomes the first one. Either way exactly one payout exists.

Pick the key carefully. It has to be stable for the retry and unique for a genuinely new payout. Generating a fresh uuid on each attempt gives you no protection at all, which is the usual mistake. Do not use the amount and phone number as the key either, or a customer legitimately being paid the same amount twice gets silently deduplicated into one payment.

When you are unsure whether something went out, retrying with the original key is safer than checking and guessing.