https://nalar.dev/tags/dpop/ Recent content in DPoP on Nalar Hugo en-us Sat, 19 Sep 2026 00:00:00 +0000 https://nalar.dev/dpop-binds-oauth-tokens-to-client-keys/ Sat, 19 Sep 2026 00:00:00 +0000 https://nalar.dev/dpop-binds-oauth-tokens-to-client-keys/ <p>A bearer access token normally authorizes whichever party can present its value to a resource server. Copying the token can therefore move its authority away from the client that originally received it. OAuth 2.0 Demonstrating Proof of Possession, or DPoP, changes that property by binding a token to a public key and requiring a signed proof from the corresponding private key during presentation.</p> <p>That binding narrows one important failure mode, but it does not turn the key into a universal client identity. DPoP is an application-layer sender-constraining mechanism. Its guarantees depend on the token binding, proof validation, replay policy, TLS, and the security of the client execution context.</p>