Binds a token to the client that holds it. Zero providers in the catalog declare it.
DPoP
Authentication IANA permanent reached by regulation
A bearer token is called that for a reason: whoever bears it may use it. DPoP (RFC 9449) changes that by having the client prove possession of a key on every request, so a stolen token is useless without the key that goes with it.
It is where the regulated world is heading — FAPI 2.0 profiles adopt sender-constrained tokens, and the regimes that mandate FAPI will follow. No provider in this catalog declares it yet.
That zero is not a criticism. It is a timestamp. This is what a header looks like before adoption, and the catalog exists partly so that the next time we look, the number means something.
The registry
Listed in the IANA HTTP Field Name Registry as a permanent entry. Defined in RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP).
In the catalog
Registered with IANA and declared by not one of the 26,641 providers in the API Evangelist catalog. A registered field with no observed use is still part of the vocabulary — it just is not part of the practice.
Reached by regulation
This header is mandated: the law, or a technical standard the law makes binding, names it directly. Only a credentialed caller can watch it in flight. The catalog can see that a contract declares it; it cannot see that a deployment honours it, and this site never claims otherwise.
Using it
Adopt it with your authorisation server rather than on your own — DPoP is a protocol between client, AS and RS, and a resource server validating proofs that nobody issues achieves nothing. Enforce nonces for replay resistance, and keep the acceptable clock skew tight.
Reached by these regulations
Catalogued at regulations.apievangelist.com, with the basis of each connection recorded rather than implied.
Governed by these rules
Machine-enforceable governance rules from rules.apievangelist.com that apply to this header when it appears in an OpenAPI.
OpenAPI Components Headers Error error
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Components Headers Info info
Utilizing the headers object in the centralized OpenAPI components library helps make headers reusable across API requests and responses
Guidance: Rate Limits →OpenAPI Headers Hyphenated Pascal Case error
HTTP headers should follow Hyphenated-Pascal-Case naming convention for consistency and readability, such as Content-Type, X-Request-Id, or Accept-Language.
Guidance: Naming →OpenAPI Security Schemes API Keys In Header Error error
Having components security schemes which possesses an api-key property that allows to configure how API keys are applied to operations have a in of header set.
Guidance: Security →OpenAPI Security Schemes API Keys Info info
Having components security schemes which possesses an api-key property that allows to configure how API keys are applied to operations.
Guidance: Security →