If a user needed to perform multiple operations, how would an idempotency key based on userId work?

An idempotency key based on userId is not suitable for multiple consecutive operations because it is only unique for the user, not for each operation. If only userId is used, then repeated requests from the same user will be perceived as duplicates of the same operation, and subsequent operations will simply be ignored.

To support multiple operations, an idempotency key must be generated that uniquely identifies each operation, for example, by combining userId with a unique operation identifier (transactionId, timestamp, nonce). This way, the server can distinguish different operations of the same user and process them correctly, preventing the re-execution of exactly the same requests.