DPoP
In short: DPoP, Demonstrating Proof of Possession, binds an OAuth token to a key the client holds. Each request carries a fresh signed proof, so a stolen token is useless without the key. It is a lighter alternative to mTLS for sender-constrained tokens.
Where does it show up in practice?
Descope supports DPoP.