Google adds DPoP support to its OAuth platform for securing refresh tokens

Google's OAuth Platform now supports DPoP, an RFC 9449 profile that binds tokens to a client-held key pair, for refresh tokens only. Access tokens stay standard Bearer tokens to avoid per-request signature verification at high API volumes.

The article also says DBSC covers browser session cookies, and that multi-agent delegation should use Google Cloud Secure Token Service because oauth2.googleapis.com does not support RFC 8693 token exchange.