@flopay/react 1.4.10 → 1.4.12

package/README.md

@@ -357,11 +357,17 @@ Skip the backend API route — create the session directly in the component:
 The component POSTs to the billing API, gets the full session back, and renders the form — zero backend code needed.
 
 That create POST sends a stable `Idempotency-Key` header automatically whenever a
-secure RNG is available, so a timeout or lost response never mints a second
-session. `FloPayCheckout` already coalesces concurrent mounts (StrictMode
-double-mount, Suspense remount, navigation flicker) into a single create, and
-rerenders during an in-flight create do **not** replace the key. You normally
-don't need to think about it.
+secure RNG is available. `FloPayCheckout` resolves the key once per logical
+checkout, stores it with the inline-session cache in `sessionStorage`, and reuses
+it across transport retries, effect reruns, and component remounts. Concurrent
+mounts (StrictMode double-mount, Suspense remount, or navigation flicker) share
+both the session create and the auto-mode payment attempt, so one purchase cannot
+fan out into multiple creates or charges.
+
+Logical checkout identity is based on the merchant, buyer, cart/pricing, and
+coupons. Checkout-mode changes, refreshed payment tokens, and analytics/UTM prop
+churn do not rotate the key while that purchase is active. A different cart or
+buyer gets a different key; an email-less buyer is separated by `account.userId`.
 
 To control the key yourself — for example to keep it stable across your own
 server retries — pass `idempotencyKey` on `createSession`: