---
title: "OAuth in practice — FoxAuth"
description: "Notes on OAuth 2.1, OpenID Connect and running your own authorization server, written by the team building FoxAuth as we hit things worth writing down."
canonical: "https://foxauth.dev/blog/"
lastmod: "2026-09-18T10:28:02+03:00"
---
Blog
OAuth in practice
What we learned building an authorization server, written down while it is still fresh. Protocol decisions, the traps that cost us a day, and the operational questions the reference documentation does not answer.
Subscribe with the feed, or read the getting started guide if you would rather try it than read about it.

2026-09-18
What DPoP protects you from, and what it doesn't
A leaked access token is a password for whoever finds it. DPoP binds it to a key the client keeps: what that buys, what it costs, and when I would not bother.