How should clients retry failed requests safely?

Summary

Retry only errors that are transient and requests that are safe to repeat (idempotent, or protected with an idempotency key); use capped exponential backoff with jitter; limit attempts; and enforce a retry budget so retries cannot multiply load during an outage. Retry at one layer, not at every layer.

Longer Answer

If each of three layers retries three times, one user request can become 27 backend requests during an incident. Jitter spreads retries so clients do not stampede in sync. A retry budget (for example, retries may be at most 10% of requests) caps amplification. Respect Retry-After and 429 responses, and do not retry errors that will not change (400, 403, validation).

Key Points

• Transient errors and idempotent requests only.
• Exponential backoff + jitter, capped.
• Retry budgets limit amplification.
• One layer retries.

Deep dive: Resilience Patterns