An alternate to this would be to use a random string that points to the same payload (in a db). But this would require a db query for each API call.. so to prevent that latency, we used the stateless verification approach.