[reinkrul]

Part of the Read the Docs → wiki move (stacked on #4678).

deployment/oauth.rst, DPoP section, expanded after review:

• what DPoP is (RFC 9449), in short
• how the Nuts node uses it: DPoP-bound tokens by default (token_type: Bearer to opt out), the key comes from the requesting subject's DID document (dpop_kid in the token response), introspection returns the key thumbprint as cnf.jkt
• how to use it: the client creates a proof per request with POST /internal/auth/v2/dpop/{kid}; the resource server checks cnf.jkt and validates with POST /internal/auth/v2/dpop/validate (what that API checks, and that other RFC 9449 checks are the resource server's job)
• links to the wiki for the use case step-by-step guides (Make the FHIR call, Validate the access token)

The rest of the page (RFC list, Authorization Code Flow, VP Token Grant, OpenID4VCI, StatusList2021) is unchanged.

Assisted by AI