Short access token lifetimes (a few minutes for high-risk APIs, RFC 6819) contain bearer theft. Sender-constrained tokens (OAuth mTLS, RFC 8705, or DPoP, RFC 9449) make a stolen token string useless without the holder’s private key.