A sender-constrained token is an access token bound to its legitimate presenter. If the token leaks, possession alone is not enough to use it against an API. section 7.5
This protects the user’s permissions from attackers who steal access tokens. The API verifies proof that the request comes from the legitimate token holder, rather than trusting the token alone. section 7.5
Use either of the OAuth 2.1 binding approaches:
- mTLS binds the token to the legitimate owner’s client certificate. section 10.4 section 7.8
- DPoP requires the client to include a newly signed DPoP token with every request, using a user-exclusive key. section 10.4 section 7.8
FAPI 2.0 access-token protection
A financial-grade API requires sender-constrained tokens so an attacker cannot use another user’s stolen access token. The token is bound through mTLS or accompanied by DPoP proof. section 10.4
