[Native SSO] DPoP support

[bitbucket-import-issues]

Originally submitted by Takahiko Kawasaki (Takahiko Kawasaki) on 2025-04-21

OpenID Connect Native SSO for Mobile Apps 1.0 - draft 07, Section 4.4. “Token Exchange Response” requires the token_type to be bearer.

token_type

REQUIRED. The value of this parameter MUST be bearer.

This requirement prevents the specification from being used in conjunction with RFC 9449: OAuth 2.0 Demonstrating Prof of Possesion (DPoP), which uses DPoP as the token_type.

It would be better to adjust the wording of this requirement to allow Native SSO and DPoP to be used together.

---

Bitbucket status: new

Bitbucket origin: issue 2175

[bitbucket-import-issues]

Originally submitted by gffletch (gffletch) on 2026-02-05

This is a great point. At the time this spec started, Bearer was the only option. I agree that DPoP should be supported and there is a goal to allow for the device_secret to be DPoP protected.