Spring Authorization Server ships inside Spring Security 7. This server-side guide covers enabling DPoP and RFC 8693 Token Exchange, the silent .dPoP() opt-in change in 7.1, and combining both safely.