--- title: Never Trust the Token: DPoP and Sender-Constraining for... description: Bearer tokens are fundamentally insecure because possession alone grants access — a stolen token gives an attacker full access. Germany's federal API... canonical: https://daily.dev/posts/never-trust-the-token-dpop-and-sender-constraining-for-government-apis-vjxctjijv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Never Trust the Token: DPoP and Sender-Constraining for Government APIs | daily.dev og:description: Bearer tokens are fundamentally insecure because possession alone grants access — a stolen token gives an attacker full access. Germany's federal API... og:url: https://daily.dev/posts/never-trust-the-token-dpop-and-sender-constraining-for-government-apis-vjxctjijv og:image: https://api.daily.dev/og/posts/vJxCtjijV.png og:image:alt: Never Trust the Token: DPoP and Sender-Constraining for Government APIs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Never Trust the Token: DPoP and Sender-Constraining for Government APIs **[API Evangelist](https://daily.dev/sources/apievangelist)** · 5 min read · 0 upvotes · 0 comments ## Summary Bearer tokens are fundamentally insecure because possession alone grants access — a stolen token gives an attacker full access. Germany's federal API authorization blueprint addresses this with sender-constraining via DPoP (RFC 9449), which binds access tokens to a client-held cryptographic key, requiring proof of possession on every request. DPoP was chosen over mutual TLS at the edge because it requires no PKI infrastructure, works across all client types (browser, mobile, native), and integrates lightly with existing OAuth/OpenID setups. However, mTLS is still used for internal machine-to-machine communication between stable, server-side infrastructure components where certificate management is practical. The key insight is that mature security architecture applies different mechanisms at different boundaries based on context, rather than picking one universal solution. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [foojay – a place for friends of OpenJDK](https://daily.dev/posts/foojay-a-place-for-friends-of-openjdk-z8wkts0jd) · Foojay.io · 0 upvotes · 0 comments - [A Stolen Token Is Useless. A Stale One Still Works.](https://daily.dev/posts/a-stolen-token-is-useless-a-stale-one-still-works--1mcdf6whq) · API Evangelist · 1 upvotes · 0 comments - [mTLS vs OAuth 2.0 for Service-to-Service Authentication: A Technical Comparison](https://daily.dev/posts/mtls-vs-oauth-2-0-for-service-to-service-authentication-a-technical-comparison-jsnjjcx35) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/never-trust-the-token-dpop-and-sender-constraining-for-government-apis-vjxctjijv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Never Trust the Token: DPoP and Sender-Constraining for Government APIs","url":"https://daily.dev/posts/never-trust-the-token-dpop-and-sender-constraining-for-government-apis-vjxctjijv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/never-trust-the-token-dpop-and-sender-constraining-for-government-apis-vjxctjijv"},"datePublished":"2026-07-28T12:52:28.296Z","dateModified":"2026-07-28T12:52:49.873Z","description":"Bearer tokens are fundamentally insecure because possession alone grants access — a stolen token gives an attacker full access. Germany's federal API...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/15aed9b15a1662bab0da3fd638c36070?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/15aed9b15a1662bab0da3fd638c36070?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"API Evangelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"API Evangelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a36244ae67bc4f41a605f780267ecb5f","url":"https://daily.dev/sources/apievangelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/never-trust-the-token-dpop-and-sender-constraining-for-government-apis-vjxctjijv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,oauth","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"API Evangelist","item":"https://daily.dev/sources/apievangelist"},{"@type":"ListItem","position":3,"name":"Never Trust the Token: DPoP and Sender-Constraining for Government APIs"}]} ```