Protect Your Data with the OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) Extension

Secure your client apps with the Demonstrating Proof-of-Possession (DPoP) extension. DPoP cryptographically binds OAuth access and refresh tokens to your client. To use a token, clients must prove that they own the private key. Even if a threat actor steals an OAuth token, they can’t use it to access your data.

Where: This change is available in Lightning Experience and Salesforce Classic for both external client apps and connected apps. External client apps are available in Professional, Enterprise, Performance, Unlimited, and Developer editions. Connected apps are available in Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions.

For more information about which flows and endpoints support DPoP, see the resources at the end of this release note.

When: Available on a rolling basis starting October 5, 2026.

How: In your external client app or connected app OAuth settings, enable “Require DPoP (Demonstrating Proof of Possession).” Then, implement DPoP in your client-side code. As part of your implementation, your client must generate special JSON Web Tokens (JWTs) called DPoP proofs. To easily generate DPoP proofs, use the new JWTUtil.generateDPoPProofForToken(httpMethod, httpUri, dpopCert, nonce, token) Apex method.