RFC 9449
A standards specification published by the IETF that defines the complete framework for OAuth 2.0 DPoP, including token binding, the nonce mechanism, and error responses.
Timeline (last 90 days)
RFC 9449 (OAuth 2.0 Demonstrating Proof of Possession) is a standards specification published by the IETF that defines the complete DPoP framework, including binding for access tokens and refresh tokens, the nonce mechanism, error responses, and more.
The standard DPoP specification (RFC 9449) covers both access tokens and refresh tokens, whereas Google's current choice is to mandate binding only for refresh tokens, with access tokens still being Bearer.
The technical foundation of DPoP comes from IETF RFC 9449, which was officially published in 2023.
DPoP (Demonstration of Proof-of-Possession) is defined by RFC 9449 and is an extension mechanism designed for OAuth 2.0 in which the client generates a short-lived DPoP Proof JWT for each request, binding the access token to a specific client key pair.
All Facts (4)
RFC 9449 (OAuth 2.0 Demonstrating Proof of Possession) is a standards specification published by the IETF that defines the complete DPoP framework, including binding for access tokens and refresh tokens, the nonce mechanism, error responses, and more.
50%UnverifiedThe standard DPoP specification (RFC 9449) covers both access tokens and refresh tokens, whereas Google's current choice is to mandate binding only for refresh tokens, with access tokens still being Bearer.
50%UnverifiedThe technical foundation of DPoP comes from IETF RFC 9449, which was officially published in 2023.
50%UnverifiedDPoP (Demonstration of Proof-of-Possession) is defined by RFC 9449 and is an extension mechanism designed for OAuth 2.0 in which the client generates a short-lived DPoP Proof JWT for each request, binding the access token to a specific client key pair.
50%