Cybersecurity glossary
What is a Sender-Constrained Token?
Learn what sender-constrained tokens are, how mTLS and DPoP bind OAuth access tokens to a client key, why they beat pure bearer tokens, and when to deploy them.
Definition
A sender-constrained token is an access credential that is cryptographically bound to a client key so that presenting the token alone is insufficient—the caller must also prove possession of the bound private key, typically via mutual TLS or DPoP proofs.
Why possession-only tokens fall short
If an access token appears in a log, proxy trace, or XSS exfil channel, a bearer API will honor it. Sender-constrained tokens change the rules: the token is bound to a client key, and resource servers demand proof of that key on each use.
This is one of the most important OAuth hardening upgrades for high-risk APIs.
How constraint works conceptually
Client holds a key pair
Generated for DPoP or provisioned as an mTLS certificate.
AS binds the token to the key
Access token includes a confirmation thumbprint (for example cnf claim).
Client calls the API with proof
mTLS handshake or DPoP proof JWT accompanies the access token.
Resource server verifies both
Token validity plus proof-of-possession matching the bound key.
Stolen token alone fails
Replay without the private key is rejected.
mTLS vs DPoP at a glance
| Aspect | mTLS-bound | DPoP-bound |
|---|---|---|
| Proof channel | TLS client certificate | HTTP DPoP proof header |
| Infra needs | TLS termination that preserves client cert | App-layer verification support |
| Mobile/SPA fit | Harder for browsers | Designed for public clients |
| Maturity | Widely used in service meshes | Growing OAuth BCP recommendation |
Benefits and residual risks
Stops many replays
Log and trace leaks become less catastrophic.
Raises attacker cost
Need token and key material together.
Complements short TTL
Defense in depth with brief access-token lifetimes.
Key theft remains fatal
Malware on the client can still abuse proofs.
Misconfiguration risk
RS that skip proof checks reintroduce bearer behavior.
Operational complexity
Key lifecycle and gateway support must be designed.
Adoption checklist
- Identify APIs where bearer token theft would be unacceptable.
- Choose mTLS, DPoP, or both based on client types and infrastructure.
- Ensure resource servers enforce confirmation claims—not only the AS.
- Bind refresh tokens where offline access is enabled.
- Keep access tokens short-lived even when constrained.
- Monitor proof failures that may indicate theft attempts.
- Document client key storage requirements for mobile and workloads.
- Test that a raw token replay without proof is rejected end-to-end.
The practical takeaway
A sender-constrained token restores a proof-of-possession property that bearer tokens lack. Stolen strings stop being universal API keys.
Use mTLS or DPoP on sensitive resource servers, enforce proofs everywhere tokens are accepted, and remember that endpoint compromise still requires classical client hardening.
Related security terms
Bearer Token
Possession-only model that sender constraints improve upon.
Demonstrating Proof of Possession (DPoP)
Application-layer mechanism to sender-constrain OAuth tokens.
Mutual TLS (mTLS)
Transport-layer client certificates used for token binding.
Token Replay
Attack class sender constraints are designed to reduce.
OAuth 2.0
Framework where sender-constrained access tokens are increasingly recommended.
Frequently asked questions
What is a sender-constrained token in simple terms?
It is an access token that only works when the caller also proves they hold a private key tied to that token—so stealing the token string from logs is usually not enough.
How is this different from a bearer token?
Bearer tokens authorize whoever presents them. Sender-constrained tokens require an extra proof of possession for the legitimate client.
What are the main ways to constrain senders?
OAuth mutual TLS (certificate-bound tokens) and DPoP (proof JWTs signed per request) are the primary standardized approaches.
Do sender constraints stop all token theft?
No. Attackers who steal the private key or fully compromise the client can still act. Constraints stop many replay cases where only the token value leaked.
When should teams require sender-constrained tokens?
High-value APIs, admin interfaces, financial operations, and any environment where bearer token exfiltration is a realistic threat.
Are refresh tokens sender-constrained too?
They can and often should be. Binding refresh usage prevents silent renewal after token theft.
Is token binding the old browser Token Binding standard?
Not the same. ‘Sender-constrained’ here refers to OAuth PoP mechanisms like mTLS and DPoP, not the deprecated HTTP Token Binding spec.
References
Explore authoritative guidance and frameworks related to sender-constrained token.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.