How should shopping be done in a store?

Question

Electronic commerce

I write payment in the key store. I've been sitting for a long time, I can't figure out how to properly implement order processing.
Option 1. There is a basket (an array in the session with product id, quantity, etc.), when paying, if you create an unpaid order and send the client to the checkout, the number of available keys will decrease (they will be reserved for this order), but if the client does not pay for the order , then it will still hang in the database and it will be possible to delete it, for example, with a cron (if 5 minutes have passed since the creation of orders, and they have not been paid, we return the keys to circulation). But because of this, it seems to me, there will be a big load, and someone will be able to constantly reserve the keys and not pay for them ...
Option 2. Send the client to pay for the order and, after receiving the payment result, create an order with keys. It would seem that everything is fine, but as always there is one BUT ... Let's imagine the situation:
The game has 5 keys for sale. Vasya added 3 keys to the cart, for himself and his friends. He was sent to pay for the order, but at that time Vasya remembered the dumplings boiling in the kitchen and ran to turn off the stove. While Vasya was heroically saving dumplings, Petya took and paid for the purchase of 4 keys. Then the unsuspecting Vasily comes, pays for the goods, he is redirected to our store, where he receives ... He receives an error that there are no longer such a number of keys for sale ...
And so, what should I do in such a situation, alas, I don't know...

Answer 1

1. There will be no charge
2. Refund
With electronic goods, it is not often possible to get a problem out of stock

Answer 2

You correctly noted that you have two options - to reserve keys (there are enough of them) and get the opportunity to ddos ​​your store, ordering but not paying for the goods, or not to reserve - and solve the out of stock problem by making a refund.
Choose what is easier for you, it is quite possible that the refund may turn out to be paid for you (as the merchant decides, this happens with international payments) - which in turn will give the attacker a ddos ​​tool and already your payment system with refunds (which will cost you money), the attacker he simply acquires a dozen or a hundred virtual bank cards / registers many wallets in electronic payments - and your store goes bankrupt.