DPoP: What It Is, How It Works, and Why Bearer Tokens Aren’t Enough

DPoP is one of the most exciting developments in the identity and access management (IAM) space in recent years. Yet many backend developers either have not heard of it or are unsure what it actually changes. In this article, I will break down what DPoP is, what problem it solves, and walk through a working implementation with Keycloak and Quarkus.

What Is DPoP?

Demonstration of Proof-of-Possession (DPoP) is an OAuth 2.0 security mechanism defined in RFC 9449. Its core purpose is simple: cryptographically bind an access token to the client that requested it. This way, even if a token is intercepted, it cannot be used by another client.