Blog

OAuth in practice

What we learned building an authorization server, written down while it is still fresh. Protocol decisions, the traps that cost us a day, and the operational questions the reference documentation does not answer.

Subscribe with the feed, or read the getting started guide if you would rather try it than read about it.

2026-09-18
What DPoP protects you from, and what it doesn't
A leaked access token is a password for whoever finds it. DPoP binds it to a key the client keeps: what that buys, what it costs, and when I would not bother.

OAuth in practice

What DPoP protects you from, and what it doesn't