From 6b74ecb49f58e1401b308075cc23928e82f761b0 Mon Sep 17 00:00:00 2001
From: Matan Kushner <hello@matchai.dev>
Date: Thu, 20 Aug 2026 23:52:48 +0200
Subject: [PATCH] fix: require DPoP for loopback clients

---
 crates/tranquil-oauth/src/client.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/tranquil-oauth/src/client.rs b/crates/tranquil-oauth/src/client.rs
index b9d9f07..c67b655 100644
--- a/crates/tranquil-oauth/src/client.rs
+++ b/crates/tranquil-oauth/src/client.rs
@@ -223,7 +223,7 @@ impl ClientMetadataCache {
             response_types: vec!["code".into()],
             scope,
             token_endpoint_auth_method: Some("none".into()),
-            dpop_bound_access_tokens: Some(false),
+            dpop_bound_access_tokens: Some(true),
             jwks: None,
             jwks_uri: None,
             application_type: Some("native".into()),
-- 
2.51.2