It's a new proposed standard. Where I work (in healthcare in Europe) we have it as a requirement for any new APIs we offer public access to. We have our own auth service, but looks like Okta already offers DPoP.