Google OAuth adds DPoP to secure refresh tokens

Google announced DPoP (Demonstrating Proof-of-Possession) support in its OAuth Platform on October 15, 2026. The mechanism cryptographically binds refresh tokens to a client key, neutralizing stolen-token reuse by infostealer and AiTM attacks, while access tokens remain standard Bearer tokens.

• DPoP sender-constrains refresh tokens via a client key pair per RFC 9449
• A stolen refresh token is useless without a valid DPoP proof signature
• Access tokens stay Bearer to avoid high-QPS API overhead
• Google Cloud STS handles secure token delegation for MCP and multi-agent workloads