Modest Destiny https://blog.modest-destiny.com 2026-10-03 Zola 0.23.0 The Token That Cannot Tell You Who Holds It https://blog.modest-destiny.com/posts/dpop-01-token-cannot-tell/ 2026-10-03 A bearer token can authorize a request without telling the API which client is making it. From Possession to Proof https://blog.modest-destiny.com/posts/dpop-02-from-possession-to-proof/ 2026-10-03 DPoP binds an access token to a key and asks the client to sign a fresh description of each request. One Request, Three Checks https://blog.modest-destiny.com/posts/dpop-03-one-request-three-checks/ 2026-10-03 A DPoP verifier turns a proof into a decision by checking the key, the request, and the proof's freshness. DPoP in the Industrial Neighborhood https://blog.modest-destiny.com/posts/dpop-04-industrial-neighborhood/ 2026-10-03 DPoP is one sender-constraint design among bearer tokens, mTLS, platform keys, and custom request signatures. Where the Proof Gets Sharp https://blog.modest-destiny.com/posts/dpop-05-where-proof-gets-sharp/ 2026-10-03 DPoP's difficult work lives at boundaries: keys, URLs, clocks, proxies, replay caches, and incomplete support. The Shape of the Tradeoff https://blog.modest-destiny.com/posts/dpop-06-shape-of-tradeoff/ 2026-10-03 DPoP accepts application complexity to make copied tokens less useful across ordinary HTTP deployments.