Bind an access token to a client key with Demonstrating Proof of Possession (DPoP).

A normal bearer access token may be usable by anyone who steals a copy. Demonstrating Proof of Possession (DPoP) reduces that risk by binding the token to a key held by the client. The client must then prove possession of that private key when it uses the token.

The client creates a key pair and uses the private key to sign a DPoP proof. During token issuance, the authorization server connects the access token to the client’s public key. On each protected request, the client creates a fresh proof that covers important request details such as the Hypertext Transfer Protocol (HTTP) method and target address.

The application programming interface (API) verifies the proof, checks that its public key matches the key bound to the token, and performs replay checks on the proof. A copied token by itself is therefore not enough; the attacker also needs the private key.

DPoP is useful for clients that can protect a key but cannot use certificate-based mutual Transport Layer Security. It does not replace Hypertext Transfer Protocol Secure (HTTPS), audience checks, expiration, scopes, or resource authorization. It adds sender proof to a token that still needs all of the normal validation.