🔐
AB-139
mTLS-bound access tokens
What it means
Your OAuth metadata supports mTLS certificate-bound tokens (optional).
Why it matters
mTLS token binding (RFC 8705) binds access tokens to a client certificate, providing the strongest form of sender-constrained tokens.
✗
What's wrong
No tls_client_certificate_bound_access_tokens in OAuth metadata.
✓
What's right
OAuth metadata: { tls_client_certificate_bound_access_tokens: true }
Check this rule on your site
Enter your URL to check just this one rule (AB-001).