This is one of the issues raised in a conversation with @dteleguin https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop DPoP spec talks explicitly about binding Access Tokens. Solid-OIDC only uses * [4. ](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop#section-4)[DPoP Proof JWTs](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop#name-dpop-proof-jwts) * [6.1. ](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop#section-6.1)[JWK Thumbprint Confirmation Method](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop#name-jwk-thumbprint-confirmation) Since access tokens themselves are out of scope for Solid-OIDC. We should double-check if there are any possible issues of using DPoP Proof JWT with ID TOken
Activity