OAuth 2.0 Proof-of-Possession (PoP) Security Architecture

Document Type Replaced Internet-Draft (individual)
Authors Phil Hunt  , Justin Richer  , William Mills  , Prateek Mishra  , Hannes Tschofenig 
Last updated 2014-07-15 (latest revision 2014-06-26)
Replaced by draft-ietf-oauth-pop-architecture
Stream Internet Engineering Task Force (IETF)
Intended RFC status Proposed Standard
Expired & archived
plain text xml pdf htmlized bibtex
Stream WG state Adopted by a WG
Document shepherd No shepherd assigned
IESG IESG state Replaced by draft-ietf-oauth-pop-architecture
Consensus Boilerplate Unknown
Telechat date
Responsible AD Kathleen Moriarty
Send notices to oauth-chairs@ietf.org

This Internet-Draft is no longer active. A copy of the expired Internet-Draft can be found at


The OAuth 2.0 bearer token specification, as defined in RFC 6750, allows any party in possession of a bearer token (a "bearer") to get access to the associated resources (without demonstrating possession of a cryptographic key). To prevent misuse, bearer tokens must to be protected from disclosure in transit and at rest. Some scenarios demand additional security protection whereby a client needs to demonstrate possession of cryptographic keying material when accessing a protected resource. This document motivates the development of the OAuth 2.0 proof-of-possession security mechanism.


Phil Hunt (phil.hunt@yahoo.com)
Justin Richer (jricher@mitre.org)
William Mills (wmills@yahoo-inc.com)
Prateek Mishra (prateek.mishra@oracle.com)
Hannes Tschofenig (Hannes.Tschofenig@gmx.net)

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)