The DPoP Proof JWT Header Is Missing
Nov 28, 2025
API Access Management
Okta Classic Engine
Okta Identity Engine
Overview
The purpose of this article is to resolve the following error with the /token request:
"error": "invalid_dpop_proof",
"error_description": "The DPoP proof JWT header is missing."
Applies To
- Demonstrating Proof of Possession (DPoP)
- invalid_dpop_proof
- The DPoP proof JWT header is missing.
- Service app
- /token request
Cause
This error occurs because the application has the Require Demonstrating Proof of Possession (DPoP) header enabled in Applications > Applications > General Settings, but the /token request does not include the DPoP proof header.
Solution
Make sure that the /token request has the DPoP header, as mentioned in Configure OAuth 2.0 Demonstrating Proof-of-Possession, or disable the Require Demonstrating Proof of Possession (DPoP) header enabled in Applications > Applications > General Settings.
