oauth.net
DPoP — Demonstrating Proof of Possession
DPoP cryptographically binds an access token to the client's private key. Even if the token is stolen, an attacker can't use it without the corresponding key.
When to use this
Use DPoP when you need sender-constrained tokens — typically in high-security deployments like financial APIs or when implementing FAPI 2.0. DPoP is required or recommended by FAPI 2.0 and provides stronger security than plain Bearer Tokens without requiring mutual TLS infrastructure. It works well for both browser-based and native app clients.
DPoP works by having the client generate an asymmetric key pair and send a signed JWT proof with each request. The authorization server binds the issued access token to the public key. The resource server verifies the proof on each request, ensuring only the client with the matching private key can use the token.
See also
- Bearer Tokens — the simpler alternative (no key binding)
- Mutual TLS RFC 8705 — certificate-based sender-constraining