Unverified50% confidenceFactExact time
When issuing a token, the authorization server embeds the fingerprint of the client's public key (jkt) into the token (usually via the cnf claim); when using a refresh token to exchange for a new access token, a valid DPoP proof must also be provided, and the server verifies the signature, the jkt match, and the consistency of request parameters.
1
Sources
50%
Confidence
Long-term
Relevance
10/20/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedFor signature-based verifiable claims (such as JWTs signed with a private key), the recipient can verify the signature but cannot confirm the true ownership of the key.74% similarVerifiedIn the embedded token scenario, the server signs the token with a private key, and the Databricks platform uses the corresponding public key to verify the signature's integrity.69% similarUnverifiedSync-in 2.5 strengthens the OnlyOffice callback verification security mechanism, ensuring that callback requests must carry a valid JWT-signed token.69% similarUnverifiedIn the signed token plus server-side context approach, the client carries a JWT or session cookie, and the server, after verifying the signature in the gateway or middleware, writes the user ID, tenant ID, and permission scope into the request context, with business code only reading that context.68% similarUnverifiedDPoP is a mechanism that binds tokens to client keys, requiring the client to sign each request with a private key to prove possession of the bound key.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1076444API
curl https://kongchang.com/api/v1/knowledge/claims/1076444MCP
get_claim(id=1076444)