OKF Explorer OKF knowledge page
Record metadata
type: "Glossary term"
title: "Sender-constrained token"
description: "A token usable only by the client that presents the right proof."
tags: [glossary]
generated: { by: human:crpage, at: 2026-07-09T09:44:00Z }
aliases: "sender-constrained token; sender constrained; proof-of-possession"
status: stable

Definition

A credential bound to the presenting client (via mTLS or DPoP) so a stolen token cannot be replayed by another party — unlike a bearer token.

Used in this bundle

Appears in: dpop, mtls-bound-tokens, identity-and-authorisation.

Related terms

bearer token.