Bind a token to a client certificate with mutual Transport Layer Security (mTLS).
Mutual Transport Layer Security (mTLS) lets both sides of a connection authenticate with certificates. OAuth can bind an access token to the client certificate so a copied token cannot be used without the matching private key.
Why this lesson?
A backend service calls a high-value application programming interface (API). The operator wants a stolen access token to be unusable unless the caller also proves possession of the approved client certificate.
Learning goal and prerequisites
Establish mutual Transport Layer Security at the token endpoint
The confidential client connects to the authorization server using mutual Transport Layer Security. During the handshake, the client presents its certificate and proves possession of the matching private key. The authorization server verifies that certificate according to its configured client trust rules.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
A bearer token can be replayed by someone who steals it. High-value machine-to-machine systems sometimes need stronger proof that the token is being used by the same client that received it. Mutual Transport Layer Security (mTLS) can provide that proof with client certificates.
In normal Transport Layer Security, the server proves its identity to the client. With mutual Transport Layer Security, the client also presents a certificate and proves possession of the matching private key. The authorization server can then issue an access token that is cryptographically associated with that client certificate.
When the client calls the protected application programming interface (API), it presents both the bound token and the approved certificate during the secure connection. The API checks that the certificate used on the connection matches the certificate binding represented by the token. A copied token presented with a different certificate is rejected.
This is useful for managed backend services that can protect certificates and private keys. It also adds operational work: certificate issuance, trust configuration, rotation, expiration, and proxy handling must all be correct. Certificate binding strengthens token presentation but does not replace audience, permission, or resource checks.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.