Security1 hOctober 30, 2026, 02:00

Google adopts DPoP to protect OAuth 2.0 tokens from theft

Google's OAuth platform now supports Demonstrating Proof-of-Possession (DPoP), which cryptographically binds tokens to a client-generated key pair so stolen tokens cannot be replayed without the private key. DPoP applies only to refresh tokens, while shorter-lived access tokens remain standard Bearer tokens.

InfoQ

Open source

Google adopts DPoP to protect OAuth 2.0 tokens from theft

DPoP binds tokens to a client-side asymmetric key pair
Protection covers only Google OAuth refresh tokens
Google and WICG are developing DBSC for session cookies
Google Cloud STS is recommended for multi-agent delegation

#Google#OAuth#DPoP

Google OAuth adds DPoP to secure refresh tokens

Security

NIST publishes final guidance on protecting tokens from forgery and theft

Policy

Google Workspace to block AI agents without OAuth flag on Nov 11

Security

Google adopts DPoP to protect OAuth 2.0 tokens from theft

Google OAuth adds DPoP to secure refresh tokens

NIST publishes final guidance on protecting tokens from forgery and theft

Google Workspace to block AI agents without OAuth flag on Nov 11

Dashlane: Passkey Authentications Double but Adoption Remains Low