All IAM glossary termsProtocols · glossary
DPoP
Also known as: Demonstrating Proof of Possession · DPoP
Definition
DPoP (Demonstrating Proof of Possession, RFC 9449) binds an OAuth access token to a specific client key, ensuring that stolen tokens cannot be replayed by an attacker without the corresponding private key.
In more depth
DPoP solves the "stolen bearer token" problem in OAuth. The client generates a key pair and includes a DPoP proof (a signed JWT proving possession of the private key) with each protected resource request. The resource server validates that the access token is bound to the same key.
DPoP is required by FAPI 2.0 and increasingly adopted by sensitive APIs. It's a more lightweight alternative to mTLS-bound tokens.
Want the work, not just the definition?