Yes, that's the case if you use it for unauthenticated users or public API calls.

For that reason I do not support idempotent retries for public API calls.

For the authenitcated users, you cache/store the idempotency keys scoped by the currently authenticated user, i.e:

  {user_id, idempotency_key}

You can add more parts to thie key for better security, i.e.:

  {user_id, api_call_name, idempotency_key}

or even

  {user_id, api_call_name, input_args_hash,  idempotency_key}

etc.