RFC 9449 defines OAuth 2.0 Demonstrating Proof of Possession (DPoP), a mechanism that binds access tokens to a client's public key via a JWT header, requiring clients to prove possession of the corresponding private key when using tokens. This prevents unauthorized use of leaked or stolen tokens by constraining legitimate token use to the party holding the private key.