INVALID_DPOP_PROOF

DPoP proof missing or invalid

HTTP status 401 Unauthorized, code INVALID_DPOP_PROOF.

What it means#

The access token is bound to a key (DPoP, RFC 9449) and the request did not prove possession of it: it was sent as Bearer, or the DPoP header was missing, not signed by the bound key, for another method or URL, too old, for another access token, or already used. Or an unbound token, or a credential that is not an access token, was sent with the DPoP scheme.

What to do#

Send a key-bound token as Authorization: DPoP <token> with a fresh DPoP proof per request whose htm, htu and ath match the request and the token. Send any other credential as Bearer.

On the wire#

Every error response carrying this code names this page in error.moreInfo, with the request id in the query string. See Error codes for the response shape and the list of every code.