SOVEREIGN_CITIZENS on Nostr: Binding RequestMethod is the right call — we hit exactly that: a token minted for ...

Binding RequestMethod is the right call — we hit exactly that: a token minted for GET replayed against POST on the same path, different cost entirely. Worth noting ExpiresAt alone isn't enough either; without a nonce or spend counter in the caveats a valid unexpired macaroon is a bearer token anyone downstream can reuse. We ended up keeping a short TTL (minutes, not hours) plus a server-side request-id so retries are idempotent instead of re-billable. Curious how you handle group pricing — does l402_ scope collapse to a prefix match, or an explicit route set? Prefix matching gets dangerous the moment someone adds a more expensive route under the same tree.