Title

OAuth 2.0 DPoP Profile

Description

DPoP, an abbreviation for Demonstrating Proof-of-Possession at the Application Layer, is an application-level mechanism for sender-constraining OAuth access and refresh tokens. It enables a client to demonstrate proof-of-possession of a public/private key pair by including a "DPoP" header in an HTTP request. The OAuth 2.0 Proof of Possession Profile is based on the internet draft ID OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer1.

Taxonomy

Standards

Guidance

Proof-of-Possession IS supported between the Client and the Authorization Server; and, Client and Resource Server.

Status

Utilization