DPoP is an OAuth mechanism that cryptographically binds an access token to the specific client that requested it, so a stolen token can't simply be replayed by an attacker from a different device. It's particularly relevant for agentic systems, where tokens may be held by automated software rather than a human keeping a browser session secure.
Frequently asked questions
What does DPoP protect against that a normal access token doesn't?
A normal (bearer) token can be used by anyone who has it; a DPoP-bound token requires proof the requester also holds the private key it was issued with, so a copied token alone isn't enough.
Does DPoP replace the need for short-lived tokens?
No, they're complementary; short lifetimes limit the window of exposure, while DPoP limits what a stolen token can be used for even within that window.
.avif)