Is it safer to use timestamp in REST authentication? I am working on a personal project to build a REST authentication system which authenticate clients via three parameters:

apikey = example-apikey-34433
hash = examplehash-notarealhash-a34io4oehosseesr
timestamp = 2000000000


Every client has a unique apikey and secret key, stored in a database.

Hash is a SHA256 hash of the secret key + timestamp. This is to generate a unique authentication hash for every request.

Would this be secure against brute forcing? Because when a client can supply any timestamp, is it true that multiple hashes can be correct?

Wouldn't it be better to just rely on the apikey and (plain text) secret key? Or do you know a better way to do this?
Might need some clarification, but it sounds like you are wondering how to 'salt' the hash. First if you intend to concatenate the secret key with anything else, the standard way to handle this is a HMAC. A common way to handle this is PBKDF2:

https://en.wikipedia.org/wiki/PBKDF2

Basically this does a secure combination of secret codes and the timestamp/salt. While the user can supply the timestamp, the probability that they could guess a timestamp that gives the same hash is very unlikely.

So PBKDF2 with a timestamp salt may be what you're looking for. Good Luck!