Every request is signed
A withdrawal is signed with the X-Timestamp and X-Merchant-Signature headers: an HMAC-SHA256 of the amount, token, network and destination address. The timestamp is valid for ±30 seconds, so an intercepted request will not replay.