Dpop (Section)#
Path: /profiles/profile/settings/authorization-server/dpop
Configure custom DPoP behavior
Parameters#
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| proof-token-clock-skew | uint32 | optional | 10 | Maximum allowed clock skew for DPoP proof tokens, in the future or in the past. |
| token-dpop-binding | enumeration (required, client-requested) | optional | client-requested | When ‘required’, the token request must carry a valid DPoP proof; when ‘client-requested’, tokens are bound only when a proof is presented. Used as a default for clients that do not override it. Does not affect HAAPI flows, which have their own DPoP settings under capabilities/haapi. |
| public-client-tokens-to-bind-with-dpop | enumeration (refresh-token-only, access-token-and-refresh-token) | optional | access-token-and-refresh-token | Which tokens a public client gets DPoP-bound when DPoP is used. Used as a default for public clients that do not override it. This value is consulted for public clients only; confidential clients are always access-token-only. |
Subsections#
| Name | Type | Description |
|---|---|---|
| allowed-signing-algorithms | Section | The asymmetric signing algorithms accepted for DPoP proofs in this profile. |