Cybersecurity glossary

What is a Sender-Constrained Token?

Learn what sender-constrained tokens are, how mTLS and DPoP bind OAuth access tokens to a client key, why they beat pure bearer tokens, and when to deploy them.

Identity and accessUpdated July 23, 2026
Also known asProof-of-possession tokenPoP access tokenKey-bound access token

Definition

A sender-constrained token is an access credential that is cryptographically bound to a client key so that presenting the token alone is insufficient—the caller must also prove possession of the bound private key, typically via mutual TLS or DPoP proofs.

Why possession-only tokens fall short

If an access token appears in a log, proxy trace, or XSS exfil channel, a bearer API will honor it. Sender-constrained tokens change the rules: the token is bound to a client key, and resource servers demand proof of that key on each use.

This is one of the most important OAuth hardening upgrades for high-risk APIs.

How constraint works conceptually

1

Client holds a key pair

Generated for DPoP or provisioned as an mTLS certificate.

2

AS binds the token to the key

Access token includes a confirmation thumbprint (for example cnf claim).

3

Client calls the API with proof

mTLS handshake or DPoP proof JWT accompanies the access token.

4

Resource server verifies both

Token validity plus proof-of-possession matching the bound key.

5

Stolen token alone fails

Replay without the private key is rejected.

mTLS vs DPoP at a glance

AspectmTLS-boundDPoP-bound
Proof channelTLS client certificateHTTP DPoP proof header
Infra needsTLS termination that preserves client certApp-layer verification support
Mobile/SPA fitHarder for browsersDesigned for public clients
MaturityWidely used in service meshesGrowing OAuth BCP recommendation

Benefits and residual risks

Stops many replays

Log and trace leaks become less catastrophic.

Raises attacker cost

Need token and key material together.

Complements short TTL

Defense in depth with brief access-token lifetimes.

Key theft remains fatal

Malware on the client can still abuse proofs.

Misconfiguration risk

RS that skip proof checks reintroduce bearer behavior.

Operational complexity

Key lifecycle and gateway support must be designed.

Adoption checklist

  • Identify APIs where bearer token theft would be unacceptable.
  • Choose mTLS, DPoP, or both based on client types and infrastructure.
  • Ensure resource servers enforce confirmation claims—not only the AS.
  • Bind refresh tokens where offline access is enabled.
  • Keep access tokens short-lived even when constrained.
  • Monitor proof failures that may indicate theft attempts.
  • Document client key storage requirements for mobile and workloads.
  • Test that a raw token replay without proof is rejected end-to-end.

The practical takeaway

A sender-constrained token restores a proof-of-possession property that bearer tokens lack. Stolen strings stop being universal API keys.

Use mTLS or DPoP on sensitive resource servers, enforce proofs everywhere tokens are accepted, and remember that endpoint compromise still requires classical client hardening.

Related security terms

Frequently asked questions

What is a sender-constrained token in simple terms?

It is an access token that only works when the caller also proves they hold a private key tied to that token—so stealing the token string from logs is usually not enough.

How is this different from a bearer token?

Bearer tokens authorize whoever presents them. Sender-constrained tokens require an extra proof of possession for the legitimate client.

What are the main ways to constrain senders?

OAuth mutual TLS (certificate-bound tokens) and DPoP (proof JWTs signed per request) are the primary standardized approaches.

Do sender constraints stop all token theft?

No. Attackers who steal the private key or fully compromise the client can still act. Constraints stop many replay cases where only the token value leaked.

When should teams require sender-constrained tokens?

High-value APIs, admin interfaces, financial operations, and any environment where bearer token exfiltration is a realistic threat.

Are refresh tokens sender-constrained too?

They can and often should be. Binding refresh usage prevents silent renewal after token theft.

Is token binding the old browser Token Binding standard?

Not the same. ‘Sender-constrained’ here refers to OAuth PoP mechanisms like mTLS and DPoP, not the deprecated HTTP Token Binding spec.

References

Explore authoritative guidance and frameworks related to sender-constrained token.

Explore every security definition

Return to the glossary to search by term, alias, starting letter, or security category.

Browse glossary