---
schema_version: "1"
id: 0f744a357e2e9a7a887f2ab776217046a2003afa75c224b8e420b9fee0962149
title: Protect Your Data with the OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) Extension
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_security_dpop.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_dpop.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: f391ee81a96c91f1daa0d738789218e7866b177737f3e748c6f6f8ad5c748cb7
description: Secure your client apps with the Demonstrating Proof-of-Possession (DPoP) extension. DPoP cryptographically binds OAuth access and refresh tokens to your client. To use a token, clients must prove that they own the private key. Even if a threat actor steals an OAuth token, they can’t use it to access your data.
products:
  - Cross Cloud
release: "264"
---
# Protect Your Data with the OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) Extension

Secure your client apps with the Demonstrating Proof-of-Possession (DPoP) extension. DPoP cryptographically binds OAuth access and refresh tokens to your client. To use a token, clients must prove that they own the private key. Even if a threat actor steals an OAuth token, they can’t use it to access your data.

**Where:** This change is available in Lightning Experience and Salesforce Classic for both external client apps and connected apps. External client apps are available in Professional, Enterprise, Performance, Unlimited, and Developer editions. Connected apps are available in Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions.

For more information about which flows and endpoints support DPoP, see the resources at the end of this release note.

**When:** Available on a rolling basis starting October 5, 2026.

**How:** In your external client app or connected app OAuth settings, enable “Require DPoP (Demonstrating Proof of Possession).” Then, implement DPoP in your client-side code. As part of your implementation, your client must generate special JSON Web Tokens (JWTs) called DPoP proofs. To easily generate DPoP proofs, use the new JWTUtil.generateDPoPProofForToken(httpMethod, httpUri, dpopCert, nonce, token) Apex method.

#### See Also

- [_Salesforce Help_: OAuth 2.0 DPoP Guide](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_dpop_guide.htm&language=en_US)
- [_Salesforce Help_: OAuth 2.0 DPoP Supported Flows and Endpoints](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_dpop_supported_flows.htm&language=en_US)