ajax – why multiple calls to wp_create_nonce() return same value?

By default, the lifetime of a nonce is one day. The nonce is generated by concatenating a variable representing the current day, the user id, and the name of the action, and hashing the resulting string.

If you want the nonce value to change more frequently, you can filter the ‘nonce_life’ value. This function, for example, will force nonces to change every hour:

function nonce_hourly() {
    return 3600;
    }
add_filter( 'nonce_life', 'nonce_hourly' );

But this doesn’t sound exactly like what you’re trying to do, either. You may have better luck generating the kind of one-time nonces you want by using a different name for the “action” value of the nonce, one that will be truly unique to the specific action you’re trying to perform. It looks as though you’re using “nonce-roll” as the action name for some distinct actions that you want to be able to check separately — maybe you can use a more specific action name for each action you’re trying to perform and authorize.