Cross Domain · security identity
DPoP (Demonstrating Proof of Possession) (RFC 9449)
DPoP binds an access token to a key held by the client, so a stolen token cannot be replayed by anyone else. The client proves possession of the key on each request with a signed JWT, turning a bearer token into a sender-constrained one without requiring mutual TLS.
Also known as DPoP (Demonstrating Proof of Possession), RFC 9449.
Providers that carry DPoP (Demonstrating Proof of Possession) 0
No provider in the catalog carries this standard as a tag yet. That is a statement about the catalog's tagging, not about adoption: a provider that implements DPoP (Demonstrating Proof of Possession) and says so in its APIs.json profile appears here on the next build. Add or correct a listing.
Read from the API Evangelist standards directory. Provider links come from the catalog's own identity tags and are rebuilt nightly. If this page is wrong about a standard or a provider, say so.