From 5ff0242b9ab32d3f13e40328acba675bbd99777b Mon Sep 17 00:00:00 2001
From: hisanhunais <hisan.live@gmail.com>
Date: Wed, 19 Aug 2026 10:28:50 +0530
Subject: [PATCH] Fix incorrect cnf example in Certificate Bound Access Tokens
 doc

---
 ...securing-apis-using-certificate-bound-access-tokens.md | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/en/docs/design/api-security/api-authentication/securing-apis-using-certificate-bound-access-tokens.md b/en/docs/design/api-security/api-authentication/securing-apis-using-certificate-bound-access-tokens.md
index 85a68ea8e6..4847e69734 100644
--- a/en/docs/design/api-security/api-authentication/securing-apis-using-certificate-bound-access-tokens.md
+++ b/en/docs/design/api-security/api-authentication/securing-apis-using-certificate-bound-access-tokens.md
@@ -104,9 +104,13 @@ Import the certificate and private key to Postman.
    
      The token comprises of client certificate thumbprint as the cnf claim.
    
+    ```json
+    "cnf": {
+      "x5t#S256": "mgw1cKxzkr7hSkCOyziXiFKobTjLwIf-7uqrLJoHufE"
+    }
     ```
-    "cnf", "{"x5t#S256": "9a0c3570ac7392bee14a408ecb38978852a86d38cbc087feeeeaab2c9a07b9f1"}"
-    ```
+
+     The `x5t#S256` value is the base64url-encoded SHA-256 thumbprint of the DER-encoded client certificate, as defined in [RFC 8705](https://www.rfc-editor.org/rfc/rfc8705#name-jwt-certificate-thumbprint-).
 
 4. Invoke the API from Postman.