From 271e2f8a205a2415bcb66987d77fba0e1c636bd8 Mon Sep 17 00:00:00 2001 From: catsika Date: Tue, 27 Oct 2026 02:24:41 +0000 Subject: [PATCH] docs: use a fresh random UUID per operation for idempotency keys A guessable key lets anyone with the same client API key and an identical request replay the original response, including a floating checkout's session secret. --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 00c1f13..baa487d 100644 --- a/README.md +++ b/README.md @@ -232,6 +232,8 @@ key, err := client.CreateKey(keymint.CreateKeyParams{ }) ``` +Use a fresh random UUID for each operation and reuse it only to retry that same operation. Never derive it from the license key or host ID: a replay returns the original response, including floating-session secrets. + ## License MIT