The response body itself for key requests, such as for license validations, contains a timestamp to prevent replay attacks. You can also send nonces, which will

The response body itself for key requests, such as for license validations, contains a timestamp to prevent replay attacks. You can also send nonces, which will be echoed back. :) But it is worth mentioning -- I am working on improving the request signature header to include more info such as current token and date. Just need to finish some other stuff on the roadmap first.