Record metadata

type: "Specification"
title: "DPoP — RFC 9449"
description: "Application-layer sender-constraining without mutual TLS."
resource: "https://www.rfc-editor.org/rfc/rfc9449"
tags: [oauth, dpop, security]
generated: { by: human:crpage, at: 2026-07-09T09:44:00Z }
status: stable
sources: [{ id: primary, resource: "https://www.rfc-editor.org/rfc/rfc9449" }]

Demonstrating Proof-of-Possession sender-constrains tokens at the application layer, mitigating replay of stolen tokens. Strong for browser/mobile or heterogeneous clients; still maturing in many stacks.

Terms

Glossary terms used here: Sender-constrained token.