Cybersecurity glossary
What is Demonstrating Proof of Possession (DPoP)?
Learn what OAuth DPoP is, how proof JWTs bind access tokens to a client key, how DPoP stops bearer replay, and implementation tips for authorization and resource servers.
Definition
Demonstrating Proof of Possession (DPoP) is an OAuth 2.0 application-layer mechanism where a client proves control of a public/private key pair by sending signed DPoP proof JWTs with token requests and API calls, enabling sender-constrained access tokens bound to that key.
Why OAuth needed an app-layer proof of possession
Browser and mobile clients struggle with mTLS client certificates. Bearer access tokens remain easy to replay when leaked. DPoP gives those clients a practical way to bind tokens to a key they control and prove possession on each request.
It is increasingly recommended in OAuth security guidance for sender-constrained access.
How DPoP works
Client generates a key pair
Typically an ephemeral asymmetric key stored in the client.
Prove possession at the token endpoint
Token requests include a DPoP proof JWT; AS binds the issued access token to the key.
Access token carries confirmation
A cnf thumbprint links the token to the DPoP public key.
API calls include DPoP proofs
Each request sends Authorization and a fresh DPoP proof for method+URL.
Resource server verifies
Checks token, proof signature, htm/htu, jti freshness, and key match.
What DPoP mitigates
Stolen access tokens
Replay without the private key fails at compliant resource servers.
Log and trace leakage
Authorization headers alone become insufficient.
Some XSS exfil scenarios
Raises bar if private keys are non-extractable—still not magic against full XSS.
Public-client constraints
Works where mTLS client certs are awkward.
Implementation pitfalls
| Pitfall | Result | Fix |
|---|---|---|
| RS ignores DPoP | Token behaves as bearer | Enforce proofs on every protected route |
| Reusable proofs | Intercepted proof replay | Track jti; bind htm/htu |
| Clock skew too wide | Expanded replay window | Tight iat tolerances |
| Extractable JS keys | XSS steals key+token | Hardened storage; reduce XSS |
Adoption checklist
- Support DPoP at the authorization server when issuing sender-constrained tokens.
- Require DPoP proofs on resource servers that advertise DPoP-bound tokens.
- Use fresh proofs per request with unique jti values.
- Bind proofs to exact HTTP method and URL; be careful with proxies and path normalization.
- Prefer non-extractable keys where the platform allows.
- Combine with short access-token lifetimes and refresh rotation.
- Monitor proof validation failures as potential theft signals.
- Test that a raw bearer replay without DPoP is rejected.
The practical takeaway
DPoP sender-constrains OAuth tokens using application-layer proof JWTs. It closes many bearer replay paths without requiring mTLS client certificates.
Issue bound tokens, enforce proofs at the API, keep proofs fresh, and remember that full client compromise still demands classical app hardening.
Related security terms
Sender-Constrained Token
Broader category of tokens that require proof of possession.
Bearer Token
Possession-only model DPoP is designed to improve upon.
Mutual TLS (mTLS)
Transport-layer alternative for constraining token senders.
Token Replay
Attack class reduced when DPoP proofs are enforced.
OAuth 2.0
Framework extended by DPoP for public and confidential clients.
Frequently asked questions
What is DPoP in simple terms?
Your app holds a private key and must sign a tiny proof for each token use. The API checks that the access token is bound to that key—so a stolen token string without the key fails.
Which RFC defines DPoP?
RFC 9449 defines OAuth 2.0 Demonstrating Proof of Possession (DPoP).
How is DPoP different from mTLS-bound tokens?
mTLS binds tokens to a TLS client certificate. DPoP binds tokens using application-layer proof JWTs, which is often easier for browser and mobile clients.
What is in a DPoP proof?
A JWT signed with the client’s key including HTTP method, URL, unique jti, and when presenting an access token, a hash of that token.
Does DPoP replace PKCE?
No. PKCE protects authorization code exchange. DPoP constrains later access-token use. Use both.
What happens if a proof is replayed?
Servers should reject reused jti values within a window and ensure proofs match method/URL, limiting replay even if intercepted.
When should teams adopt DPoP?
When bearer token exfiltration is a realistic risk—especially for public clients and high-value APIs—and mTLS is impractical.
References
Explore authoritative guidance and frameworks related to demonstrating proof of possession (dpop).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.