Help us shape the future of Go! Take the 2026 Go Developer Survey

Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

dpop

package

Go to main page

Versions in this module

v1

v1.9.0

Nov 2, 2026

Changes in this version

+ const DefaultIatLeewayFuture

+ const DefaultIatLeewayPast

+ const DefaultNonceTTL

+ const MaxProofBytes

+ var ErrATHMismatch = errors.New("dpop: ath does not match presented token")

+ var ErrBadSignature = errors.New("dpop: proof signature invalid")

+ var ErrKeyMismatch = errors.New("dpop: proof key does not match bound token")

+ var ErrMalformedProof = errors.New("dpop: malformed proof")

+ var ErrMethodMismatch = errors.New("dpop: htm does not match request method")

+ var ErrNonceMismatch = errors.New("dpop: nonce mismatch")

+ var ErrNonceRequired = errors.New("dpop: nonce required")

+ var ErrNonceSecretMissing = errors.New("dpop: nonce signing secret not configured")

+ var ErrReplayed = errors.New("dpop: proof jti replayed")

+ var ErrStaleProof = errors.New("dpop: proof iat outside acceptable window")

+ var ErrURIMismatch = errors.New("dpop: htu does not match request URI")

+ var ErrUnsupportedAlg = errors.New("dpop: unsupported proof algorithm")

+ func AccessTokenHash(token string) string

+ func SupportedAlgs() []string

+ func WithRequestScope(ctx context.Context) context.Context

+ type Config struct

+ IatLeewayFuture time.Duration

+ IatLeewayPast time.Duration

+ Nonce NonceVerifier

+ Now func() time.Time

+ Replay ReplayCache

+ type Expectation struct

+ AccessToken string

+ ExpectedJKT string

+ Method string

+ NonceRequired bool

+ URL string

+ type MemoryReplayCache struct

+ func NewMemoryReplayCache(maxEntries int) *MemoryReplayCache

+ func (c *MemoryReplayCache) Evictions() uint64

+ func (c *MemoryReplayCache) Seen(_ context.Context, key string, ttl time.Duration) (bool, error)

+ type Mode string

+ const ModeOff

+ const ModeOptional

+ const ModeRequired

+ func MaxMode(a, b Mode) Mode

+ func ParseMode(s string) Mode

+ type NonceSigner struct

+ func NewNonceSigner(secret []byte, ttl time.Duration) (*NonceSigner, error)

+ func (s *NonceSigner) Issue(jkt string) string

+ func (s *NonceSigner) NeedsRefresh(nonce string) bool

+ func (s *NonceSigner) Verify(jkt, nonce string) bool

+ type NonceVerifier interface

+ Verify func(jkt, nonce string) bool

+ type Proof struct

+ ATH string

+ Alg string

+ HTM string

+ HTU string

+ IssuedAt time.Time

+ JKT string

+ JTI string

+ JWK json.RawMessage

+ Nonce string

+ PublicKey crypto.PublicKey

+ Raw string

+ Typ string

+ func Parse(raw string) (*Proof, error)

+ type ReplayCache interface

+ Seen func(ctx context.Context, key string, ttl time.Duration) (bool, error)

+ func NewCeremonyReplayCache(s ceremony.Store) ReplayCache

+ type Validator struct

+ func NewValidator(cfg Config) *Validator

+ func (v *Validator) Validate(ctx context.Context, p *Proof, e Expectation) error

v1.8.3

Oct 20, 2026

v1.8.2

Oct 20, 2026

v1.8.1

Oct 18, 2026

v1.8.0

Oct 18, 2026

v1.7.2

Sep 1, 2026

v1.7.1

Aug 28, 2026

v1.7.0

Aug 26, 2026