Announcing DPoP Support for Google OAuth: Securing Refresh Tokens- Google Developers Blog

Introduces DPoP (Demonstrating Proof-of-Possession) as an application-layer OAuth 2.0 security profile (RFC 9449) to secure refresh tokens against theft and replay attacks. Details Google's specific implementation, which binds refresh tokens to client-generated asymmetric keypairs while keeping access tokens as standard Bearer tokens for performance. Discusses architectural considerations for BFF, Token-Mediating Backend, and Browser-based OAuth Client models, and highlights DPoP's resilience in multi-hop environments. Contrasts DPoP with transport-layer binding and mentions Device Bound Session Credentials (DBSC) as a complementary protection for web session cookies. Explains how to use Google Cloud Secure Token Service (STS) for multi-agent delegation in scenarios not supported by the core consumer OAuth endpoint.