Google Adds DPoP Support to OAuth to Protect Refresh Tokens from Theft
Google has announced support for DPoP (Demonstrating Proof-of-Possession, RFC 9449) in its OAuth platform, cryptographically binding refresh tokens to a client-generated key pair so stolen tokens cannot be replayed by attackers. The protection applies only to long-lived refresh tokens, while short-lived access tokens remain standard Bearer tokens to avoid added cryptographic overhead on high-throughput API calls. Google also highlights DPoP's relevance for securing multi-agent and Model Context Protocol (MCP) architectures, recommending Google Cloud Secure Token Service for token delegation chains between agents.