Yeah, by generating a new token for each request, tracking and marking tokens as used in your backend database, and rejecting any token that has already been consumed.