OAuth2 Token Binding with DPoP — Demonstrating Proof of Possession for OAuth2 Tokens

In this tutorial, you will learn about OAuth2 Token Binding with DPoP. We cover key concepts, practical examples, and best practices to help you master this topic.

OAuth2 DPoP (Demonstrating Proof of Possession, RFC 9449) binds access tokens to a client-held private key, preventing token replay by requiring the client to prove possession of the key with every request.

sequenceDiagram
    participant Client
    participant Auth as Auth Server
    participant RS as Resource Server

    Client->>Client: Generate key pair
    Client->>Auth: Token request + JWK thumbprint
    Auth->>Auth: Record thumbprint in token
    Auth-->>Client: Access token (cnf claim with thumbprint)
    Client->>Client: Create DPoP proof (signed header with nonce)
    Client->>RS: Request + DPop proof + access token
    RS->>RS: Verify DPoP proof signature
    RS->>RS: Verify proof thumbprint matches token cnf
    RS-->>Client: Response
    Note over Client,RS: Each request requires a new DPoP proof

What's Next

Explore {{< ilink "OAuth" "OAuth2 Client Authentication Methods" }} and combine with {{< ilink "OAuth" "OAuth2 Security Best Practices" }}.