Securing Token Endpoints

Analogy categoryAnalogies

Client Authentication at the Token Endpoint

The token endpoint is where authorization codes, refresh tokens, and client credentials all ultimately get exchanged for access tokens, which makes it the single highest-value target in an OAuth deployment. Confidential clients must authenticate on every call, typically via client_secret_basic, sending the client_id and client_secret as an HTTP Basic Authorization header, or the stronger private_key_jwt method, where the client signs a short-lived JWT assertion with its own private key instead of transmitting a shared secret at all. Public clients that cannot hold a secret rely on PKCE plus, ideally, additional binding like DPoP to prove possession of the original request.

🏏

Cricket analogy: A ground's players' entrance checking full biometric ID for every single entry rather than a quick glance at a lanyard mirrors the token endpoint requiring strong, repeated authentication on every call, since it's the highest-value access point.

Rate Limiting and Brute-Force Resistance

Because the token endpoint accepts client_secret, refresh_token, and authorization code values directly, it is a natural target for brute-force and credential-stuffing attempts, and it must be rate-limited per client_id, per IP, and ideally per combination of the two, with exponential backoff on repeated authentication failures. Refresh token grants deserve particular attention: a server should detect refresh token reuse, where the same refresh token is presented twice after rotation has already issued a new one, and treat that as a signal of token theft, immediately revoking the entire token family rather than just rejecting the single reused request.

🏏

Cricket analogy: A DRS system flagging suspicious repeated appeal patterns from the same fielding side for review mirrors the token endpoint flagging repeated failed authentication attempts as an attack signal.

Token Binding, Audience Restriction, and Short Lifetimes

Issued access tokens should be scoped to a specific audience, the resource server they're meant for, using the aud claim in a JWT-format token, so that a token leaked from one API cannot be replayed against a different API in the same organization. Sender-constrained tokens, using DPoP or mutual TLS client certificates, go further by cryptographically binding the token to the specific client that requested it, so a stolen access token is useless to an attacker who doesn't also hold the corresponding private key. Combined with short access token lifetimes, typically 5 to 15 minutes, and refresh token rotation, this limits the blast radius of any single leaked credential dramatically.

🏏

Cricket analogy: A player's central contract restricting them to represent only their national team, not any franchise that fields them, mirrors an access token's aud claim restricting it to one specific resource server.

http

POST /token HTTP/1.1
Host: authz.example.com
Authorization: Basic czZCaGRSa3F0Mzp4eHh4eHh4eHh4
Content-Type: application/x-www-form-urlencoded
DPoP: eyJhbGciOiJFUzI1NiIsInR5cCI6ImRwb3Arand0Iiwiamt1IjoiLi4uIn0...

grant_type=refresh_token
&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA

# Response includes a DPoP-bound access token whose cnf.jkt claim
# matches the thumbprint of the key used to sign the DPoP proof,
# and a rotated refresh token; the old refresh_token is invalidated
# and reuse of it triggers revocation of the entire token family.

private_key_jwt client authentication avoids ever transmitting a shared secret over the wire, which removes an entire class of token endpoint compromise where a leaked client_secret grants an attacker indefinite ability to mint tokens.

The token endpoint is the highest-value target in OAuth because every grant type resolves there into live tokens.
Confidential clients should prefer private_key_jwt over client_secret_basic where supported.
Rate limiting and exponential backoff on the token endpoint defend against brute-force and stuffing attacks.
Refresh token reuse after rotation is a strong signal of theft and should revoke the entire token family.
Audience restriction via the aud claim stops a token leaked from one API being replayed against another.
Sender-constrained tokens, via DPoP or mTLS, make a stolen access token useless without the matching key.
Short access token lifetimes combined with rotation dramatically shrink the blast radius of any leak.