%% You should probably cite rfc9449 instead of this I-D. @techreport{ietf-oauth-dpop-16, number = {draft-ietf-oauth-dpop-16}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-ietf-oauth-dpop/16/}, author = {Daniel Fett and Brian Campbell and John Bradley and Torsten Lodderstedt and Michael B. Jones and David Waite}, title = {{OAuth 2.0 Demonstrating Proof of Possession (DPoP)}}, pagetotal = 39, year = 2023, month = apr, day = 13, abstract = {This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens.}, }