DPoP for OAuth Refresh Tokens

Google's OAuth Platform now supports DPoP binding for refresh tokens, a security profile that cryptographically binds tokens to a client-generated asymmetric keypair to neutralize token theft and replay attacks. This approach balances robust protection for long-lived refresh tokens with the high performance of standard Bearer tokens for short-lived access tokens. DPoP operates at the HTTP header level, making it resilient in complex, multi-hop environments like MCP and autonomous agent architectures. For multi-agent delegation, Google Cloud Secure Token Service (STS) is recommended to maintain the sender-constrained security model.