https://nalar.dev/tags/access-tokens/ Recent content in Access Tokens on Nalar Hugo en-us Sun, 20 Sep 2026 00:00:00 +0000 https://nalar.dev/dpop-binds-oauth-access-tokens-to-a-client-key/ Sun, 20 Sep 2026 00:00:00 +0000 https://nalar.dev/dpop-binds-oauth-access-tokens-to-a-client-key/ <h1 id="dpop-binds-oauth-access-tokens-to-a-client-key">DPoP Binds OAuth Access Tokens to a Client Key</h1> <p>A bearer access token is usable by any party that obtains the token and can present it to the resource server. TLS protects the token while it crosses a correctly authenticated connection, but it does not change that bearer property after the token reaches an endpoint, log, process, browser context, or other storage location.</p> <p>Demonstrating Proof of Possession (DPoP), specified by RFC 9449, adds a key-bound layer at the application protocol. The client creates an asymmetric key pair and signs a DPoP proof JWT. An authorization server can bind an issued access token to the public key represented by that proof. The resource server then requires both the token and a valid proof created with the corresponding private key.</p>