From e025d1069982ca5127b025e7e6d706e063117f44 Mon Sep 17 00:00:00 2001
From: catsika <atsikaclifford414@gmail.com>
Date: Tue, 27 Oct 2026 02:24:39 +0000
Subject: [PATCH] docs: use a fresh random UUID per operation for idempotency
 keys

A guessable key lets anyone with the same client API key and an identical request replay the original response, including a floating checkout's session secret.
---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index d5b5803..0b52681 100644
--- a/README.md
+++ b/README.md
@@ -195,6 +195,8 @@ result = sdk.create_key({
 }, idempotency_key='9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d')
 ```
 
+Use a fresh random UUID for each operation and reuse it only to retry that same operation. Never derive it from the license key or host ID: a replay returns the original response, including floating-session secrets.
+
 ## License
 MIT