Nonrepudiation makes it possible to prove that a particular user performed a specific action or approved a message. It matters when actions carry financial or legal risk, cannot be easily reversed, or involve critically sensitive APIs. Authentication alone may show that an action used Bob’s account; it does not prove that Bob personally placed the order. section 10.6 section 10.2
A disputed nonrefundable order
Bob orders a nonrefundable product online. After delivery, he claims that a hacker took over his account and placed the order. Secure login and protected business flows show that the order was placed through his account, but message signing supplies additional evidence linking the authorization process, tokens, and token use to their legitimate user. section 10.6
Message signing creates signature proofs across the authorization and access process:
- Sign authorization requests using pushed authorization requests (PAR). section 10.7
- Sign authorization-code responses using JWT-secured authorization responses (JARM). section 10.7
- Wrap token-introspection responses in signed JWTs and sign ID tokens. section 10.7
- Use sender-constrained access tokens, such as certificate-bound or DPoP tokens, so tokens are used only by their legitimate owners. section 10.7
