Originally published on proxymint.
Privacy Pass tokens let a client prove it passed a check without saying who it is. How issuance and redemption work, where tokens run, what proxies change.
TL;DR
- Privacy Pass tokens prove a check without an identity. A client passes attestation once, an issuer blind-signs tokens, and a website later verifies one and learns only that the client was verified.
- Four roles keep the data apart. The attester knows the client, the issuer signs without seeing the token, and the origin sees only a valid token, so the token gives no party a link from identity to destination.
- Private Access Tokens are Apple's deployment. iOS 16 and macOS Ventura or later devices fetch type 2 Blind RSA tokens, with Apple as attester and Cloudflare and Fastly as issuers.
- A token never replaces the IP signal. The origin still sees the client or proxy exit IP, and a redemption context can tie cached tokens to one network.
Key takeaways
- Read a 401 on the pat path as no token, not a block. Cloudflare documents it as expected on unsupported devices, managed networks and certain VPNs, with a fallback to a standard challenge.
- Bind tokens to the origin when deploying them. RFC 9577 describes reflection and exhaustion attacks on cross-origin tokens with empty contexts.
- Never block a page on a missing token. Apple tells site owners that clients without token support must still reach the site.
- Keep one exit per session where tokens bind to a network. Clients should discard context-bound tokens after a network change, so rotating exits mid-task invites fresh challenges.
- Use signatures, not tokens, to identify a declared bot. Privacy Pass hides the sender by design; Web Bot Auth names the operator.
Read the full guide on proxymint, with the commands, tables and sources.
