A user who is authenticated to a system or service across a network can receive a token that includes a device fingerprint. The fingerprint can include information that is obtained from the client device through which the user supplied authentication credentials. The client device can be configured to include that token with subsequent requests. When a request is received, the information in the fingerprint can be extracted from the token and compared to information obtained from the device submitting that request. If the information matches within at least an allowable match threshold, for example, the request can be processed. If the information in the fingerprint does not match the current values of the device from which the request was received, the request can be denied or a remedial action performed.