From 9b2ef1f0b91a2747b16e38b08fcdc3f3033040e1 Mon Sep 17 00:00:00 2001 From: catsika Date: Tue, 27 Oct 2026 02:24:36 +0000 Subject: [PATCH] docs: use a fresh random UUID per operation for idempotency keys A guessable key lets anyone with the same client API key and an identical request replay the original response, including a floating checkout's session secret. --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 7c439f9..2ed9c6f 100644 --- a/README.md +++ b/README.md @@ -181,6 +181,8 @@ const result = await sdk.createKey({ }); ``` +Use a fresh random UUID for each operation and reuse it only to retry that same operation. Never derive it from the license key or host ID: a replay returns the original response, including floating-session secrets. + ## License MIT