Cyber Security· Important· 🧪 Worth Testing

Google Adds DPoP Support to OAuth to Protect Refresh Tokens from Theft

In short: Google has announced support for DPoP (Demonstrating Proof-of-Possession, RFC 9449) in its OAuth platform, cryptographically binding refresh tokens to a client-generated key pair so stolen tokens cannot be replayed by attackers. The protection applies only to long-lived refresh tokens, while short-lived access tokens remain standard Bearer tokens to avoid added cryptographic overhead on high-throughput API calls. Google also highlights DPoP's relevance for securing multi-agent and Model Context Protocol (MCP) architectures, recommending Google Cloud Secure Token Service for token delegation chains between agents.

Source: Google Developers15 Oct 2026, 03:00Google Original article ↗

This summary was generated automatically by AI from Google Developers's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.

What changed?

1DPoP (RFC 9449) now supported for binding Google OAuth refresh tokens to a client key pair
2Access tokens remain standard Bearer tokens to preserve API performance
3DPoP recommended for Backend-for-Frontend, Token-Mediating Backend and Browser-based OAuth Client models
4Google Cloud Secure Token Service (STS) recommended for multi-agent/MCP token delegation chains since oauth2.googleapis.com does not support RFC 8693 Token Exchange
5DBSC (Device Bound Session Credentials) positioned as a complementary protection for browser session cookies

Why it matters

Refresh token theft via infostealer malware or adversary-in-the-middle attacks is a real threat vector for any service relying on Google OAuth, including CRM, calendar, and cloud API integrations used by automation and agent pipelines; DPoP closes this gap without slowing down everyday API calls.

What it means for AI agents and contact centers

If your stack authenticates to Google services (Gmail, Calendar, Drive, Workspace) via OAuth for CRM or call-data integrations, adopting DPoP on refresh tokens reduces the risk of credential theft from compromised agent machines or browsers. For multi-agent or MCP-based tool-calling setups, check whether delegation flows need Google Cloud STS instead of relying on shared keys.

🧪 Worth Testing

Testing DPoP adoption is low-risk and targeted: it only affects refresh token handling, not access token latency, making it straightforward to pilot on integrations that touch Google APIs or MCP agent chains.

DPoP (Demonstrating Proof-of-Possession)· New

OAuth DPoP RFC 9449 Token Security MCP AiTM Infostealer API Security

Sources

Google DevelopersOfficialPrimary source
„Announcing DPoP Support for Google OAuth: Securing Refresh Tokens“
15 Oct 2026, 03:00
Original article →

Published by source: 15 Oct 2026, 03:00
Found by our system: 15 Oct 2026, 21:11
Summary generated: 15 Oct 2026, 21:12

This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy