Adding a timestamp to the API header is a common method to prevent replay attacks. It ensures that each request is unique and can only be used within a specific time frame, making it difficult for attackers to reuse the same request to brute force a system1.