feat: make DPoP opt-in by defaulting useDPoP to false

[subhankarmaiti]

Changes

useDPoP now defaults to false. From v5.1.0 through v5.x it defaulted to true, so every app got DPoP-bound tokens whether or not DPoP was actually enabled for the application in the Auth0 Dashboard. Since it has to be turned on tenant-side to be useful, it is now something you opt into explicitly.

Apps that want DPoP set it at construction:

const auth0 = new Auth0({
  domain: 'YOUR_AUTH0_DOMAIN',
  clientId: 'YOUR_AUTH0_CLIENT_ID',
  useDPoP: true,
});

Apps that never set useDPoP need no change — they now get Bearer tokens.

The default is applied in the TypeScript adapters and the Android module. iOS needed no change: NativeBridge has no default of its own and simply receives the value, so the TypeScript default governs both platforms. One small cleanup came along with it — WebAuth0Client was computing options.useDPoP ?? true twice, and the second now reuses the first so the two can't drift.

Note for existing sessions: credentials saved by a DPoP-enabled v5 app are DPoP-bound. Upgrading without setting useDPoP: true leaves the credentials manager unable to prove possession of the key, so reading those stored credentials fails with DPOP_NOT_CONFIGURED. Apps either keep useDPoP: true or clear credentials and re-authenticate — both paths are documented in the migration guide, along with the symmetric case of deliberately turning DPoP off.

Summary by CodeRabbit

• New Features

  • DPoP is now opt-in and disabled by default. Enable it with useDPoP: true.
  • Bearer tokens remain the default when DPoP is not enabled.

• Documentation

  • Updated setup guidance, examples, FAQ content, and migration instructions to reflect the new default.
  • Added guidance for re-authentication and clearing stored DPoP credentials when changing configurations.

• Bug Fixes

  • Aligned web and native authentication behavior with the documented DPoP defaults.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: feda9bdd-12c7-4ddc-9887-ddab2c6f1a2c

📥 Commits

Reviewing files that changed from the base of the PR and between 714b27b and 096080b.

📒 Files selected for processing (1)

• FAQ.md

🚧 Files skipped from review as they are similar to previous changes (1)

• FAQ.md

---

📝 Walkthrough

Walkthrough

DPoP now defaults to disabled in native and web clients. Explicit useDPoP configuration enables DPoP. Tests, examples, FAQs, migration guidance, and security guidance reflect the new default.

Changes

DPoP default configuration

Layer / File(s)	Summary
Runtime DPoP defaults src/types/common.ts, src/platforms/web/..., src/platforms/native/..., android/src/...	Native and web clients now resolve omitted useDPoP values to false.
Default behavior validation src/platforms/web/adapters/__tests__/WebAuth0Client.spec.ts, src/platforms/native/.../__tests__/*	Tests verify Bearer defaults, explicit DPoP configuration, and updated native initialization behavior.
Documentation and migration guidance CLAUDE.md, README.md, FAQ.md, EXAMPLES*.md, MIGRATION_GUIDE.md	Documentation describes DPoP opt-in configuration, Bearer behavior, and recovery after disabling DPoP.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• auth0/react-native-auth0#1599: Both changes update CLAUDE.md guidance for PKCE and DPoP configuration defaults.
• auth0/react-native-auth0#1608: Both changes affect web My Account API behavior and DPoP configuration.
• auth0/react-native-auth0#1619: Both changes modify native Android DPoP configuration.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely states the main change: DPoP is now opt-in because useDPoP defaults to false.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/dpop-default-false

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@FAQ.md`:
- Line 503: Update the migration link in the FAQ note to use the section 14
fragment, `#14-how-do-i-migrate-existing-users-to-dpop`, while preserving the
displayed link text and surrounding content.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3575ba34-0c41-4947-8ec5-f34867fa412c

📥 Commits

Reviewing files that changed from the base of the PR and between 6070018 and 714b27b.

📒 Files selected for processing (14)

• CLAUDE.md
• EXAMPLES-WEB.md
• EXAMPLES.md
• FAQ.md
• MIGRATION_GUIDE.md
• README.md
• android/src/main/java/com/auth0/react/A0Auth0Module.kt
• src/platforms/native/adapters/NativeAuth0Client.ts
• src/platforms/native/adapters/__tests__/NativeAuth0Client.spec.ts
• src/platforms/native/bridge/NativeBridgeManager.ts
• src/platforms/native/bridge/__tests__/NativeBridgeManager.spec.ts
• src/platforms/web/adapters/WebAuth0Client.ts
• src/platforms/web/adapters/__tests__/WebAuth0Client.spec.ts
• src/types/common.ts