DPoP (Demonstrating Proof of Possession)

Mon, 23 Mar 2026 00:00:00 +0000

“bearer” token grants access to the “bearer” of the token
sender-constrained tokens to solve the problem of leaked “bearer” tokens
client using a “bearer” token provides “a proof” every time it uses the token
- “proof” ensures client has a secret private key
- “proof” is usually a JWT signed by the secret private key
- binds “proof” to a specific HTTP request
application layer
no PKI required

Links

Oauth on Aashutosh Poudel