Sender-constraining is a token security control that binds a token to proof of possession, such as a private key or device-held cryptographic secret. A token is only accepted when the presenter can also prove they own the matching key, rather than simply showing the token itself.
This matters because many cloud and API tokens are otherwise bearer credentials: whoever has the string can use it. If an attacker steals or replays a bearer token, they may gain access without knowing the original password. Sender-constraining reduces that risk by making copied tokens less useful unless the attacker also has the bound proof material. Defenders use it in federation, SSO, and API access to limit replay attacks and strengthen trust in high-value identity flows.