DPoP (RFC 9449)
DPoP (Demonstrating Proof of Possession) under RFC 9449 binds an OAuth token to a client key, so a stolen token cannot be used without the matching private key.
RFC 9449 was published in September 2023. With every request, the client sends a DPoP proof alongside the token: a short JWT signed with its private key that contains method (htm), address (htu), time (iat) and a unique identifier (jti). The token itself refers to the public key. The server checks that proof and token belong together and that the proof is fresh.
Compared with classic bearer tokens, which anyone holding them can use, this is a considerable security gain. For agents that make many requests across different systems, DPoP limits the damage if a token ends up in logs or third-party systems.
Example
An agent calls a bank's interface with a token. Every request carries a fresh DPoP proof signed with the agent's key. If the token ends up in a log by mistake, an attacker can do nothing with it, because the private key is missing.
How it differs
A bearer token works like cash; a DPoP-bound token like a card with a PIN. Mutual TLS achieves a similar binding through the connection's client certificate. Key binding in SD-JWT binds not an access token but a credential to its holder.
In practice
- Bind agents' access tokens to a key with DPoP instead of using bearer tokens.
- On the server, check the time and identifier of every proof to detect reuse.
- Keep the agent's private key in protected storage and rotate it regularly.
Role in KYA
KYA verifies the related principle for evidence: the key binding JWT of an SD-JWT VC, which ties the presentation to recipient, time and the agent's key. Without this binding, the link between agent and mandate counts as not proven.
Related check: Agent and principal (subject_agent_binding). Do all parts name the same agent, is the principal named, does the agent hold the bound key?
Frequently asked questions
What does DPoP protect against?
DPoP protects against the use of stolen tokens. Without the private key a token is bound to, nobody can create a valid DPoP proof.
What does a DPoP proof contain?
Method and address of the request, the time, a unique identifier and the public key in the header. Optionally, a hash of the token and a server nonce are added.
What is the difference between DPoP and mutual TLS?
Both bind tokens to a key. Mutual TLS uses the connection's client certificate, DPoP a signed proof at the application level that also works across intermediaries.
Does KYA verify DPoP proofs?
No, DPoP concerns access to interfaces. KYA verifies the related key binding for evidence, which ties the presentation of a mandate to the agent's key.