draft ambekar oauth epop 03 JSON Web Token (JWT) Profile for OAuth 2.0 Enveloped Proof of Possession (EPOP)
Key possession addresses the presenter binding it actually verifies. It does not establish approval of an action or the legitimacy of a delegation, and the proposed cross transport behavior has not been independently exercised by Moona.
Key possession addresses the presenter binding it actually verifies. It does not establish approval of an action or the legitimacy of a delegation, and the proposed cross transport behavior has not been independently exercised by Moona.
What the source establishes
An individual EPOP draft proposes sender constrained credentials covering access and refresh tokens, key rotation and multiple transports. It extends proof of possession beyond HTTP to environments including MCP and message systems.
Moona assessment and evidence limits
Key possession addresses the presenter binding it actually verifies. It does not establish approval of an action or the legitimacy of a delegation, and the proposed cross transport behavior has not been independently exercised by Moona.
Verification scope
Moona reviewed the retained source on 29 September 2026. Source acquisition and review establish provenance for this account; they do not reproduce an experiment, validate a vendor deployment or authorize an action.
Sources
This analysis interprets third-party reporting, research and announcements. Moona is not the original reporter of the underlying events.