The OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) extension protects access to your Salesforce data. It works by cryptographically binding OAuth access and refresh tokens to the client that requested them. Even if an attacker gets access to a token, they can’t use it to access your data. You can use DPoP with most OAuth flows, and you can use DPoP-bound access tokens to request access to Salesforce resources for supported endpoints.