🔐
AB-138
DPoP token binding supported
What it means
Your OAuth metadata supports DPoP (RFC 9449) for token binding (optional).
Why it matters
DPoP binds access tokens to a cryptographic key held by the client, preventing token replay attacks even if a token is leaked.
✗
What's wrong
No dpop_signing_alg_values_supported in OAuth metadata.
✓
What's right
OAuth metadata: { dpop_signing_alg_values_supported: ['ES256', 'RS256'] }
Check this rule on your site
Enter your URL to check just this one rule (AB-001).