---
title: Proof-of-possession
description: Ensure clients possess specific cryptographic keys to access resources, mitigating token theft through proof-of-possession validation using JWK or certificate-based methods
component: pingam
version: 8
page_id: pingam:am-oauth2:oauth2-proof-of-possession
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-oauth2/oauth2-proof-of-possession.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-06-01T14:34:20Z
keywords: ["OAuth 2.0", "JWK", "Authorization", "Cryptographic Keys"]
page_aliases: ["oauth2-guide:oauth2-proof-of-possession.adoc"]
superseded_by: https://docs.pingidentity.com/pingam/8.1/am-oauth2/oauth2-proof-of-possession.html
---

# Proof-of-possession

Proof-of-possession is a means of ensuring that the client sending a request to the resource server is in possession of a particular cryptographic key. In other words, it is a way of proving the identity of the client.

Configure proof-of-possession to control which clients access your resources, or to mitigate against token theft; a malicious user with an access token must also present the cryptographic key to access the resources.

AM supports the following proof-of-possession methods:

[icon: key, set=fad, size=3x]

#### [JWK-based proof-of-possession](oauth2-PoP-JWK.html)

[icon: certificate, set=fad, size=3x]

#### [Certificate-based proof-of-possession](oauth2-PoP-Cert.html)