Google's OAuth platform now supports DPoP (RFC 9449) sender-constraining for refresh tokens, cryptographically binding them to a client keypair so stolen tokens can't be replayed, while short-lived access tokens remain standard Bearer tokens to avoid per-request verification overhead. Developers adopting DPoP must handle client-side key generation, strict timestamp/nonce handling, and DPoP proof JWT construction, and multi-agent delegation should use Google Cloud STS since the core OAuth endpoint doesn't support Token Exchange. An adoption guide and SKILL.md are available.
Read the full story on developers.googleblog.com
What to doReview the DPoP adoption guide and SKILL.md to add DPoP binding for refresh tokens in your Google OAuth integrations.
- Provider