There is a (now expired) draft for sending signed HTTP requests using JWS that includes the access token as part of the signature data getting around this probl

There is a (now expired) draft for sending signed HTTP requests using JWS that includes the access token as part of the signature data getting around this problem. Edit: forgot the link https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03 https://tools.ietf.org/html/draft-ietf-oauth-signed-http-req...