From e17d882acc32966533f80a949c8608bda3442f2d Mon Sep 17 00:00:00 2001 From: catsika Date: Tue, 27 Oct 2026 02:24:43 +0000 Subject: [PATCH] docs: use a fresh random UUID per operation for idempotency keys A guessable key lets anyone with the same client API key and an identical request replay the original response, including a floating checkout's session secret. --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 5de8d58..0bec449 100644 --- a/README.md +++ b/README.md @@ -209,6 +209,8 @@ var result = await client.CreateKey(new CreateKeyParams { }); ``` +Use a fresh random UUID for each operation and reuse it only to retry that same operation. Never derive it from the license key or host ID: a replay returns the original response, including floating-session secrets. + ## License MIT