Announcing DPoP Support for Google OAuth: Securing Refresh Tokens

DPoP is an OAuth 2.0 security profile that reduces token theft and replay risks by cryptographically binding tokens to a client-held asymmetric key pair, so stolen credentials cannot be used without the corresponding private key. Google’s OAuth Platform applies DPoP specifically to long-lived refresh tokens, protecting the most valuable credentials from persistent impersonation while retaining short-lived bearer access tokens to avoid the cryptographic overhead and latency of validating every high-volume API request. Implementing DPoP requires clients to generate and securely manage keys, construct signed JWT proofs, and handle timestamps, nonces, headers, and required claims accurately. Google recommends this approach for Backend-for-Frontend, token-mediating backend, and browser-based OAuth architectures, particularly because its HTTP-header-level design works across proxies, load balancers, and multi-hop cloud environments better than transport-layer binding methods. DPoP does not secure browser session cookies, for which Device Bound Session Credentials are being developed, and multi-agent delegation requires separate token exchange mechanisms such as Google Cloud Secure Token Service because agents cannot safely share private signing keys.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.