diff --git a/lib/vipps/vipps.ts b/lib/vipps/vipps.ts
index 47715a6..33cdeb3 100644
--- a/lib/vipps/vipps.ts
+++ b/lib/vipps/vipps.ts
@@ -1,5 +1,6 @@
 // deno-lint-ignore-file ban-ts-comment
 import "jsr:@std/dotenv/load";
+import { encodeHex } from "jsr:@std/encoding/hex";
 import { getHostUrl } from "../utils.ts";
 import { STATUS_CODE } from "$fresh/server.ts";
 
@@ -50,7 +51,8 @@ export const createAgreement = async function (email: string) {
     // @ts-ignore
     headers: {
       authorization: `Bearer ${token}`,
-      "Idempotency-Key": `${email}-${Date.now()}`,
+      // anonymized and trimmed to not be too long (then it fails)
+      "Idempotency-Key": `${encodeHex(email).slice(0, 10)}-${Date.now()}`,
       ...standardVippsHeaders,
     },
     body: JSON.stringify({
diff --git a/todo.md b/todo.md
new file mode 100644
index 0000000..fd53b0d
--- /dev/null
+++ b/todo.md
@@ -0,0 +1,12 @@
+# Bugs 
+- [ ] enter on sponsor input reloads the page 
+  - [ ] reproduce 
+  - [ ] fix 
+  - [ ] report back to user (MFA email)
+- [ ] user (MFA email) gets an error with one of his emails (see mail thread)
+  - [x] reproduce 
+  - [x] fix 
+  - [ ] report back to user 
+- [ ] there are more users registered as paying users than there are payments received 
+  - [ ] are these people supposed to still be subscribers? 
+  - [ ] how can this have happenned? 
\ No newline at end of file