topic
Verified 2026-09-18Privacy Pass PrivateToken
PrivateToken authentication lets a client prove authorization without revealing the client identity to the origin verifying the token.
Use PrivateToken only with a compatible Privacy Pass deployment and document issuer, redemption, key, and abuse controls. It provides privacy properties, not general-purpose user authentication or authorization by itself.
httpauthsecurityprivacyauthentication
Reference (http)
Authorization: PrivateToken token
Use PrivateToken only with a compatible Privacy Pass deployment and document issuer, redemption, key, and abuse controls. It provides privacy properties, not general-purpose user authentication or authorization by itself.
Common mistakes
- Assuming a valid token identifies a user, accepting tokens outside their issuer or redemption context, or omitting anti-abuse policy.