Safety & Security
Demonstrating Proof of Possession
Demonstrating Proof of Possession, or DPoP, sender-constrains an OAuth token using a key pair and signed request proofs. A receiver checks that the proof and token binding match the request. Possessing a copied token alone should not satisfy those checks. DPoP is not itself client authentication or an extra permission grant.
Also called: DPoP
Reviewed
Sources
Member lesson
The definition and sources are public. The complete practical lesson is for members.