Dpop (Section)#
Path: /profiles/profile/settings/authorization-server/ephemeral-client/dpop
DPoP binding policy for ephemeral clients in this profile. Each option that is set to a value other than ‘inherit-from-profile’ explicitly overrides the corresponding profile-wide dpop default for all ephemeral clients; an option left at ‘inherit-from-profile’ (the default) applies the profile value.
Parameters#
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| authorization-code-dpop-binding | enumeration (inherit-from-profile, required, client-requested) | optional | inherit-from-profile | Whether an ephemeral client’s authorization code must be DPoP-bound. When ‘required’, the authorize request must carry the dpop_jkt authorization request parameter; when ‘client-requested’, the code is bound only if dpop_jkt is supplied. |
| token-dpop-binding | enumeration (inherit-from-profile, required, client-requested) | optional | inherit-from-profile | Whether an ephemeral client’s token request must carry a valid DPoP proof. When ‘required’, a token request without a valid proof is rejected; when ‘client-requested’, tokens are bound only when a proof is presented. |
| public-client-tokens-to-bind-with-dpop | enumeration (inherit-from-profile, refresh-token-only, access-token-and-refresh-token) | optional | inherit-from-profile | Which tokens a public ephemeral client gets DPoP-bound when DPoP is used. Note: a client that registers dpop_bound_access_tokens=true always gets its access token DPoP-bound, so for such a public client both tokens are bound even when this is set to refresh-token-only. |