DPoP
Bind tokens to keys
DPoP explained: binding OAuth tokens to a client key
Duende's Halloween-themed walkthrough explains DPoP, the RFC 9449 extension that binds access tokens to a client's key pair. Binding stops a stolen bearer token from being replayed against an API. The post follows the token request, the cnf.jkt claim and the proof check on the API side, and it maps each step to Duende's .NET libraries.