Provider security HMAC request signatures Timestamp drift guard (+/-5 min) Idempotency key for retries Per-pour provably fair replay Seed rotation locked mid-brew