What is DPoP?
In short:DPoP, Demonstrating Proof of Possession, binds an OAuth token to a key the client holds. Each request carries a signed proof made with that key. A stolen token without the key is worthless, which matters for agents whose tokens can leak into logs and prompts.
How does it work?
The client signs a JWT proof per request; the server checks it matches the key bound into the token.
What does it look like in practice?
Descope supports DPoP for agent tokens.