# dpop

> DPoP (RFC9449) for JavaScript Runtimes

Latest version **2.1.2** (published 2026-08-24) · MIT license · 0 weekly downloads

## Install

```sh
npm install dpop
pnpm add dpop
yarn add dpop
bun add dpop
```

## Health

**Score 75/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 2.1.2 |
| Published | 2026-08-24 |
| First published | 2020-03-10 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 0 |
| Unpacked size | 23.7 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 60 |
| Author | Filip Skokan |
| Maintainers | panva |
| Keywords | dpop, rfc9449 |

## Links

- npm: https://www.npmjs.com/package/dpop
- Repository: https://github.com/panva/dpop
- Issues: https://github.com/panva/dpop/issues
- Funding: https://github.com/sponsors/panva
- npm.io page: https://npm.io/package/dpop

## Recent versions

- 2.1.2 (latest) — 2026-08-24
- 2.1.1 — 2025-07-02
- 2.1.0 — 2025-06-19
- 2.0.0 — 2025-06-19
- 1.4.1 — 2024-05-27
- 1.4.0 — 2023-09-08
- 1.3.0 — 2023-09-08
- 1.2.0 — 2023-04-26
- 1.1.0 — 2022-09-28
- 1.0.0 — 2022-05-19
- 0.7.0 — 2022-05-18
- 0.6.0 — 2021-04-08
- 0.5.5 — 2020-04-02
- 0.5.4 — 2020-04-02
- 0.5.3 — 2020-03-31
- … 4 more at https://npm.io/package/dpop/versions

## README

# dpop

> OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer ([DPoP][RFC9449]) for JavaScript Runtimes

## [💗 Help the project](https://github.com/sponsors/panva)

## Dependencies: 0

## [API Reference](docs/README.md)

`dpop` is distributed via [npmjs.com](https://www.npmjs.com/package/dpop), [jsdelivr.com](https://www.jsdelivr.com/package/npm/dpop), and [github.com](https://github.com/panva/dpop).

## Example

### ESM import[^cjs]

```ts
import * as DPoP from 'dpop'
```

### DPoP Key Pair generation

```ts
const keypair = await DPoP.generateKeyPair('ES256', { extractable: false })
```

### AS proof generation

```ts
let nonce!: string | undefined
const proof = await DPoP.generateProof(keypair, 'https://as.example.com/token', 'POST', nonce)
```

### AS Authorization Code Binding via `dpop_jkt`

```ts
const dpop_jkt = await DPoP.calculateThumbprint(keyPair.publicKey)
```

### RS proof generation

```ts
let nonce!: string | undefined
let accessToken!: string

const proof = await DPoP.generateProof(
  keypair,
  'https://rs.example.com/api',
  'GET',
  nonce,
  accessToken,
)
```

## Supported Runtimes

The supported JavaScript runtimes include those that support the utilized Web API globals and standard built-in objects. These are _(but are not limited to)_:

- Browsers
- Bun
- Cloudflare Workers
- Deno
- Electron
- Node.js[^nodejs]

## Supported Versions

| Version                                         | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
| ----------------------------------------------- | ----------------- | ------------------ | --------------- |
| [v2.x](https://github.com/panva/dpop/tree/v2.x) | [Security Policy] | ✅                 | ✅              |

[rfc9449]: https://www.rfc-editor.org/rfc/rfc9449.html
[Security Policy]: https://github.com/panva/dpop/security/policy

[^cjs]: CJS style `let dpop = require('dpop')` is possible in Node.js versions where the `require(esm)` feature is enabled by default (^20.19.0 || ^22.12.0 || >= 23.0.0).

[^nodejs]: Node.js v20.x as baseline is required

---
_Source: https://npm.io/package/dpop · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._