D
Oct 18, 2026DPoP makes a token sender-constrained, which changes what a stolen token is worth
Why sender-constrained tokens change the value of a stolen access token
Oct 18, 20263 min read0 reactions0 comments
Back to articles 
Sep 9, 2026
May 7, 2026
Tag archive
#dpop
Zero-Trust API Security: OAuth 2.1, Distributed Rate Limiting, and Automated Threat Mitigation
Architect production-grade API gateways using OAuth 2.1, DPoP, and probabilistic rate limiting to protect high-scale microservices in the modern AI-ag
Sep 9, 20269 min read0 reactions0 comments
I
Aug 19, 2026I Built DPoP in .NET 10 by Hand. Then I Found the Package That Makes It Unnecessary.
I read Michael Maurice’s “Stop Trusting Bearer Tokens” piece the same week it went up, because I had...
Aug 19, 202612 min read0 reactions0 comments
Secure Authentication by Design: The Case for DPoP as a Linear Type
Introduction: The Fragility of Modern Authentication Tokens In the contemporary landscape of...
May 7, 20265 min read0 reactions0 comments
D
Apr 6, 2026DPoP Deep Dive: The Complete Guide to Making Stolen OAuth Tokens Useless
A production-ready engineering guide to implementing DPoP (Demonstrating Proof-of-Possession) per RFC 9449. Covers why bearer tokens are broken, how cryptographic binding works, full TypeScript implementation for client and server, nonce handling, key storage strategies, and migration from bearer to sender-constrained tokens.
Apr 6, 202614 min read1 reactions0 comments
B
Jan 21, 2025Bluesky OAuth2 Client, with Vanilla JavaScript
Hi, there! ;^) Introduction This post talks about integrating Bluesky Authentication...
Jan 21, 202517 min read3 reactions0 comments