DPoP (RFC 9449)

1. Objectives

   Binding access and refresh tokens to a client key.

2. DPoP proof JWTs

   htm, htu, jti, iat, ath claims and the dpop+jwt type.

3. DPoP access token request

   Presenting a DPoP proof at the token endpoint.

4. Protected resource access

   DPoP authorization scheme and token binding checks.

5. Authorization server nonce

   Nonce challenges to bound proof lifetimes.

6. Security considerations

   Proof replay, theft and key storage.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.