# identityserver-token-security

> Claude/Codex skill by [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars · Updated 2026-10-16

Advanced token security features in Duende IdentityServer including DPoP, mTLS certificate binding, Pushed Authorization Requests (PAR), JWT Secured Authorization Requests (JAR), and FAPI 2.0 compliance configuration.

Tags: ai-agents, claude, claude-code

## Install

```sh
git clone https://github.com/DuendeSoftware/duende-skills /tmp/duende-skills && ln -s /tmp/duende-skills/skills/identityserver-token-security ~/.claude/skills/identityserver-token-security
```

## From README

Advanced Token Security (DPoP, mTLS, PAR, JAR, FAPI) When to Use This Skill Implementing Proof-of-Possession (PoP) tokens with DPoP or mTLS Configuring Pushed Authorization Requests (PAR) for front-channel parameter security Setting up JWT Secured Authorization Requests (JAR) for tamperproof authorize requests Building FAPI 2.0 compliant authorization servers Choosing between DPoP and mTLS for sender-constrained tokens Configuring APIs to validate proof-of-possession tokens Meeting regulatory or industry security requirements (open banking, e-health, e-government) Docs: https://docs.duendesoftware.com/identityserver/tokens/ Proof-of-Possession Tokens: Why They Matter Default OAuth access tokens are bearer tokens -- anyone who possesses the token can use it. If a token leaks, a malicious third party can impersonate the client/user.

## Links

- HTML page: https://omgskills.com/library/duendesoftware/duende-skills/skills/identityserver-token-security/
- GitHub: https://github.com/DuendeSoftware/duende-skills
- Author: [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md)

## More from this repo

- [aspnetcore-authentication](https://omgskills.com/library/duendesoftware/duende-skills/skills/aspnetcore-authentication/index.md) — ASP.NET Core authentication middleware configuration including OpenID Connect, JWT Bearer, cookie authentication,...
   - [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars
- [aspnetcore-authorization](https://omgskills.com/library/duendesoftware/duende-skills/skills/aspnetcore-authorization/index.md) — ASP.NET Core authorization patterns including policy-based authorization, IAuthorizationHandler implementations,...
   - [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars
- [claims-authorization](https://omgskills.com/library/duendesoftware/duende-skills/skills/claims-authorization/index.md) — Claims transformation and profile service patterns for Duende IdentityServer — IProfileService, IClaimsTransformation,...
   - [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars