liveBook · Manning

Key thumbprint

As explained in Secure APIs

A key thumbprint is a compact hash-derived identifier for a cryptographic key representation.

A key thumbprint is a compact, base64url-encoded SHA-256 identifier derived from a JSON Web Key (JWK). In DPoP, it binds an access token to a public key so the client must prove possession of the matching private key. section 7.5.2

The DPoP flow uses the thumbprint as a binding value:

  • The client generates a signing-key pair and sends the public key's thumbprint as the dpop_jkt authorization parameter. section 7.5.2
  • The authorization server binds the authorization code and resulting access token to that thumbprint. section 7.5.2
  • The client signs a DPoP JWT with the private key and sends it in each DPoP request header, proving possession. section 7.5.2

How Secure APIs covers it

How deep it goes
Explains JWK hashing, base64url representation, authorization binding, and signed-request proof without detailing hash computation internals.
Examples
Uses a dpop_jkt authorization parameter, a cnf.jkt access-token claim, and a signed DPoP JWT for a token request.
What it assumes
Assumes basic authorization-code and public-key concepts while defining JWK structure and thumbprint purpose.
What you can do after
Evaluate how DPoP binds tokens to public keys and recognize the signed request that proves private-key possession.
How it connects
Connects JWKs, SHA-256, base64url encoding, DPoP, JWTs, access tokens, and proof of possession.
Cover of Secure APIs
liveBookmanning.com
Read Secure APIs on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.