In HAIP 1.0, PoP (Proof of Possession) and DPoP (Demonstrating Proof of Possession) have different but complementary roles.
The Client Attestation PoP proves that the Wallet controls the private key bound to its Wallet Attestation, typically key A.
This PoP is a JWT signed with A, with an aud identifying the Authorization Server and a unique jti.
DPoP protects a specific HTTP request using claims such as htm, htu, iat, and jti, and can also cryptographically bind an Access Token to a key.
At the PAR Endpoint, HAIP uses Wallet Attestation + Client Attestation PoP + DPoP; the PoP aud identifies the AS, while the DPoP htu identifies the PAR Endpoint.
At the Token Endpoint, the same combination is used; the PoP aud still identifies the AS, while the DPoP htu is the exact Token Endpoint URL.
The Token Endpoint can then issue a DPoP-bound Access Token, cryptographically bound to the Wallet's DPoP key.
At the Credential Endpoint, the Wallet normally no longer sends the Wallet Attestation or Client Attestation PoP; it uses the DPoP-bound Access Token + a fresh DPoP proof.
This DPoP proof targets the Credential Endpoint through htu and uses ath to bind the proof to the presented Access Token.
Finally, the Credential Proof / Key Attestation is a separate mechanism concerning the credential holder key C, not the Wallet's OAuth client authentication.
In HAIP 1.0, PoP (Proof of Possession) and DPoP (Demonstrating Proof of Possession) have different but complementary roles.
The Client Attestation PoP proves that the Wallet controls the private key bound to its Wallet Attestation, typically key A.
This PoP is a JWT signed with A, with an aud identifying the Authorization Server and a unique jti.
DPoP protects a specific HTTP request using claims such as htm, htu, iat, and jti, and can also cryptographically bind an Access Token to a key.
At the PAR Endpoint, HAIP uses Wallet Attestation + Client Attestation PoP + DPoP; the PoP aud identifies the AS, while the DPoP htu identifies the PAR Endpoint.
At the Token Endpoint, the same combination is used; the PoP aud still identifies the AS, while the DPoP htu is the exact Token Endpoint URL.
The Token Endpoint can then issue a DPoP-bound Access Token, cryptographically bound to the Wallet's DPoP key.
At the Credential Endpoint, the Wallet normally no longer sends the Wallet Attestation or Client Attestation PoP; it uses the DPoP-bound Access Token + a fresh DPoP proof.
This DPoP proof targets the Credential Endpoint through htu and uses ath to bind the proof to the presented Access Token.
Finally, the Credential Proof / Key Attestation is a separate mechanism concerning the credential holder key C, not the Wallet's OAuth client authentication.