I'd also like to learn more about the xpsId header - x-playback-session-id - and whether it's relevant here. It seems to be a token for an individual, a bit like the ULID that @fce803cc and others were proposing. But, at least with these two requests for the same audio from the same person one millisecond apart, it doesn't seem to actually be a session ID.

https://assets.bne.social/media_attachments/files/111/069/073/017/420/252/original/0485f80092bf667c.png 

 @92f75699 How do you know it's the same person?  Could be different devices behind NAT. 

 @fce803cc True. Could be two office drones with a corporate-issue iPhone on the same network, I guess.