[API BREAK] Use a nonce-generation function instead of a nonce

nit: inconsistency in * placement everywhere for the callback data.