use the newly supplied nonce for the next token request and all subsequent token requests.

Condition: until the authorization server supplies another nonce

The client MUST use the new nonce value supplied

include more than one DPoP-Nonce header in the error response.

Condition: when returning a DPoP nonce challenge

there MUST NOT be more than one DPoP-Nonce header

generate unpredictable nonce values.

Condition: when supplying nonce values for DPoP proofs

Nonce values MUST be unpredictable.

reject the request when the nonce claim does not exactly match a nonce recently supplied to the client.

Condition: when validating a DPoP proof containing a nonce claim

the authorization server MUST reject the request

use a nonce value contributed by the authorization server in DPoP proofs to limit their lifetime.

Including a nonce value contributed by the authorization server in the DPoP proof MAY be used

supply a nonce value for the client to include in DPoP proofs.

An authorization server MAY supply a nonce value

include a DPoP-Nonce HTTP header providing a new nonce for subsequent requests.

Condition: in a response rejecting a nonce mismatch

The rejection response MAY include a DPoP-Nonce HTTP header

supply a new nonce using a DPoP-Nonce HTTP header in the response.

The authorization server MAY supply the new nonce