# dpop

Source: https://startwithidentity.com/glossary/dpop/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Demonstrating Proof of Possession (RFC 9449). Binds an access token to a specific key held by the client, so a stolen bearer token cannot be replayed. Important for high-assurance APIs that cannot rely on mTLS.

DPoP exists because bearer tokens are the last big replay hole in OAuth: steal one and you are the client. It binds the token to a key the client proves possession of on every request, so a token lifted from a browser or a log is useless elsewhere. mTLS-bound tokens do the same job with better performance where you control the transport; DPoP is the option for public clients and browser apps that cannot present a client certificate.

See also: [access token](https://startwithidentity.com/glossary/access-token/), [token theft](https://startwithidentity.com/glossary/token-theft/), [mTLS](https://startwithidentity.com/glossary/mtls/), [OAuth 2.1](https://startwithidentity.com/standards/oauth-2-1/)