DPoP and mTLS
In short:DPoP and mTLS bind an access token to a key the client holds, so a stolen token is useless on its own. DPoP does it with a signed header on each request. Mutual TLS does it with a client certificate during the connection handshake.
What is it?
With DPoP, the client signs a small proof for each request with its private key. The server checks that the token was issued for that key.
With mTLS, the token is bound to the client certificate used to open the connection.
Why do agents need it?
Agents pass tokens through logs, prompts and tool outputs. A bearer token copied from any of those works for whoever holds it.
Sender-constrained tokens close that gap without changing how the agent asks for access.
Which scored platforms name it?
Other scored platforms: not found in public material read on 3 November 2026.
Other standards
- OAuth 2.1
- MCP authorization
- Enterprise-Managed Authorization (Cross App Access, ID-JAG)
- Client ID Metadata Documents (CIMD)
- SPIFFE
- CIBA (human approval)
- OAuth token exchange (RFC 8693)
Sources
- [ds-hub] Descope Agentic Identity Hub. https://www.descope.com/blog/post/agentic-identity-hub. Read .