FoxAuth blogNotes on OAuth 2.1, OpenID Connect and running your own authorization server, written by the team building FoxAuth as we hit things worth writing down.https://foxauth.dev/enWhat DPoP protects you from, and what it doesn'thttps://foxauth.dev/blog/what-dpop-protects-you-from/https://foxauth.dev/blog/what-dpop-protects-you-from/A leaked access token is a password for whoever finds it. DPoP binds it to a key the client keeps: what that buys, what it costs, and when I would not bother.Fri, 18 Sep 2026 00:00:00 GMTdpoptokenssecurityFoxAuth