Yes, that's the case if you use it for unauthenticated users or public API calls. For that reason I do not support idempotent retries for public API calls. Fo

Yes, that's the case if you use it for unauthenticated users or public API calls. For that reason I do not support idempotent retries for public API calls. For the authenitcated users, you cache/store the idempotency keys scoped by the currently authenticated user, i.e: {user_id, idempotency_key} You can add more parts to thie key for better security, i.e.: {user_id, api_call_name, idempotency_key} or even {user_id, api_call_name, input_args_hash, idempotency_key} etc.