DPoP

As explained in Secure APIs

A DPoP JWT is a signed JSON Web Token containing proof-of-possession claims for one HTTP request.

DPoP binds an access token to a client-generated cryptographic private key. The client proves possession by signing a fresh DPoP JWT and sending it in the DPoP header with each request. section 7.5.2

Figure 7.13 DPoP binds the access token to the public key thumbprint of the client’s certificate. The client proves ownership of the certificate by including a newly signed DPoP token in every request.

The flow links the access token to a public-key thumbprint, then uses newly signed proof for requests. section 7.5.2

A typical DPoP flow works as follows:

• Generate a signing-key pair and send the public key’s SHA-256 JWK thumbprint as dpop_jkt in the authorization request. section 7.5.2
• Exchange the authorization code by signing a DPoP JWT whose claims identify the method, URL, time, and token binding. section 7.5.2
• Send a newly signed DPoP JWT with the access token on API requests; the token records the key thumbprint in its cnf.jkt claim. section 7.5.2

Proof for a token request

A DPoP JWT can identify POST https://auth.apithreats.com/token through htm and htu, include a unique jti and timing claims, and carry the access-token hash in ath. section 7.5.2

How Secure APIs covers it

How deep it goes

Explains key generation, thumbprint binding, JWT claims, and request headers, but does not detail verification logic.

Examples

Uses an authorization URL, a structured DPoP JWT, curl request headers, and a cnf.jkt-bound access token.

What it assumes

Assumes authorization-code and access-token flows while defining JWKs, thumbprints, and DPoP JWT contents.

What you can do after

Apply DPoP by generating a key pair, binding its thumbprint, signing request proofs, and attaching them to requests.

How it connects

Connects authorization codes, access tokens, JSON Web Keys, JWTs, PKCE, and mutual TLS.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Related concepts

• API keyconfigures · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• JSON Web Tokenkind of · A JSON Web Token is a compact, URL-safe representation of claims encoded as a JSON object and protected by a digital signature, message authentication code, or encryption.
• sender-constrained tokenimplements · A sender-constrained token is a token cryptographically or transport-layer bound to a particular legitimate presenter so that possession alone is insufficient for its use.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.