Glossary
Token Binding
Token binding attaches a token to the specific channel or cryptographic key it was issued over, so presenting the token from a different connection fails, even if the token string itself was copied correctly. This directly addresses the most common way tokens are stolen and misused: a token intercepted or leaked in transit, then replayed from an entirely different location.
Without binding, a token's security rests entirely on keeping the string itself secret in transit and storage. With binding, an intercepted token is far less valuable to whoever intercepts it, because using it still requires the original connection's key material.