Additional Considerations

Because the API Protection APIs are stateless, there is no record kept on whether a token has already been verified. At the very least, a shorter challenge timeout can safeguard against indefinite token reuse. You might also want to consider caching response tokens on the server and rejecting duplicate responses.

Another aspect to keep in mind is how to manage multiple versions of the app and shared secret. If you release a new app version with a new secret configuration, the back end needs to differentiate between requests using an older secret versus the newer one. For REST APIs, you might want to include a version number in the HTTP header that the server can parse out. For example: X-Response: v=1, <token>.