Its presence is; its semantics aren't. Omit the header and both intakes answer a structured 400, code 10106, naming the missing header and its HEADER location — so the sandbox proves your client sends the key and survives the designed rejection when it doesn't. Resubmitting with the same key, though, mints a brand-new payment rather than replaying the first response. If your retry logic depends on true replay-safety, model same-key-same-response in a private WireMock Cloud copy; here, assert that the key goes out on every create.