---
schema_version: "1"
id: 87bf48535e46c19639f357c64ff023465ed38bdcdbe53f2e5bb6cbe67db76475
title: Proof-of-Possession for Asset Tokens
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/remoteaccess_asset_token_pop.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.remoteaccess_asset_token_pop.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 6f0fd76ae27ecb54b2d649f97d6dbc16e6454beb82a7bb470680c3c380447cd5
description: If you construct an actor token holding the public key of your asset and sign it with your asset’s private key, Salesforce binds that public key into your asset token. This pattern allows for what’s known as Proof-of-Possession or Holder of Key. The asset can prove that it holds the private key corresponding to the public key that Salesforce binds into the cnf claim during issuance. Proof-of-Possession helps provide greater assurance that the token is being presented by the actual asset it was issued to.
products:
  - Salesforce Platform
release: "264"
---
# Proof-of-Possession for Asset Tokens

If you construct an actor token holding the public key of your asset and sign it with your asset’s private key, Salesforce binds that public key into your asset token. This pattern allows for what’s known as Proof-of-Possession or Holder of Key. The asset can prove that it holds the private key corresponding to the public key that Salesforce binds into the `cnf` claim during issuance. Proof-of-Possession helps provide greater assurance that the token is being presented by the actual asset it was issued to.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (<a href="https://help.salesforce.com/s/articleView?id=xcloud.overview_edition_lex_only.htm&amp;type=5&amp;language=en_US" target="_blank">not available in all orgs</a>) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

The holder can prove possession of the private key by various mechanisms, including TLS mutual authentication, signing of the HTTP request, or signing of a challenge.

Learn more about implementing Proof-of-Possession at:

- [https://tools.ietf.org/html/draft-ietf-oauth-pop-architecture-07](https://tools.ietf.org/html/draft-ietf-oauth-pop-architecture-07)
- [https://tools.ietf.org/html/draft-ietf-oauth-proof-of-possession-11](https://tools.ietf.org/html/draft-ietf-oauth-proof-of-possession-11)
- [https://tools.ietf.org/html/draft-sakimura-oauth-rjwtprof-06](https://tools.ietf.org/html/draft-sakimura-oauth-rjwtprof-06)