# proof-of-possession

Source: https://startwithidentity.com/glossary/proof-of-possession/
Last updated: 2026-10-16
License: content by Start with Identity. Cite the source URL.

---

Proof of possession (PoP) is a property of a token or credential that requires the presenter to show it controls a specific cryptographic key, so holding the token alone is not enough to use it. [RFC 7800](https://www.rfc-editor.org/info/rfc7800/) defines how a JWT names its PoP key in the `cnf` (confirmation) claim.

PoP is the answer to the [bearer token](https://startwithidentity.com/glossary/bearer-token/) problem, where anyone who copies a token can replay it. In OAuth, [RFC 8705](https://www.rfc-editor.org/info/rfc8705/) binds access tokens to the client's TLS certificate through [mutual TLS](https://startwithidentity.com/glossary/mtls/), and [RFC 9449](https://www.rfc-editor.org/info/rfc9449/) ([DPoP](https://startwithidentity.com/glossary/dpop/)) has the client sign a short proof with its key on each request, which suits browser and mobile apps that cannot present client certificates; FAPI 2.0 requires one or the other. The same principle applies to client authentication: in October 2026 a CVSS 10 flaw in the SAP Cloud SDK for Python [sent OAuth client IDs and secrets to an attacker-controlled host](https://startwithidentity.com/blog/2026-10-13-sap-cloud-sdk-python-flaw-sends-oauth-client-secrets-to-attackers/), whereas a client authenticating with a private key over mTLS never transmits anything an attacker could reuse.

See also: [DPoP](https://startwithidentity.com/glossary/dpop/), [mTLS](https://startwithidentity.com/glossary/mtls/), [bearer token](https://startwithidentity.com/glossary/bearer-token/), [token replay on unbound endpoints](https://startwithidentity.com/techniques/token-replay-unbound-endpoint/), [FAPI](https://startwithidentity.com/glossary/fapi/)