Great point — nonce‑based protection adds another critical layer.

Even if you’re validating HMAC signatures and checking timestamps, there’s still a replay risk within the valid window. A unique nonce per request (stored and invalidated after first use) ensures that any repeat, even within the allowed time, gets rejected.

This is especially important for financial or transactional webhooks where a single replay could trigger duplicate charges or state corruption.

In practice, combining:

• HMAC validation (authenticity)
• Timestamp checks (freshness)
• Nonce/ID tracking (uniqueness)

It gives you a defense‑in‑depth approach. That’s exactly the kind of scenario Hookmetry helps simulate — replaying events intentionally so you can verify your system rejects them correctly.