identityserver-token-security
Advanced token security features in Duende IdentityServer including DPoP, mTLS certificate binding, Pushed Authorization Requests (PAR), JWT Secured Authorization Requests (JAR), and FAPI 2.0 compliance configuration.
Install
With your agent
Install OMGSkills skill "duendesoftware/duende-skills:skills/identityserver-token-security" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/DuendeSoftware/duende-skills /tmp/duende-skills && ln -s /tmp/duende-skills/skills/identityserver-token-security ~/.claude/skills/identityserver-token-securityFrom README
Advanced Token Security (DPoP, mTLS, PAR, JAR, FAPI) When to Use This Skill Implementing Proof-of-Possession (PoP) tokens with DPoP or mTLS Configuring Pushed Authorization Requests (PAR) for front-channel parameter security Setting up JWT Secured Authorization Requests (JAR) for tamperproof authorize requests Building FAPI 2.0 compliant authorization servers Choosing between DPoP and mTLS for sender-constrained tokens Configuring APIs to validate proof-of-possession tokens Meeting regulatory or industry security requirements (open banking, e-health, e-government) Docs: https://docs.duendesoftware.com/identityserver/tokens/ Proof-of-Possession Tokens: Why They Matter Default OAuth access tokens are bearer tokens -- anyone who possesses the token can use it. If a token leaks, a malicious third party can impersonate the client/user.
More from this repo
aspnetcore-authentication
ASP.NET Core authentication middleware configuration including OpenID Connect, JWT Bearer, cookie authentication,...
aspnetcore-authorization
ASP.NET Core authorization patterns including policy-based authorization, IAuthorizationHandler implementations,...
claims-authorization
Claims transformation and profile service patterns for Duende IdentityServer — IProfileService, IClaimsTransformation,...