Google adds DPoP support for OAuth refresh tokens
Overview
Google's OAuth platform now supports DPoP, the RFC 9449 standard that binds tokens to a key pair held by the client, according to a Google Developers Blog post.
The support applies to refresh tokens only. Access tokens stay standard Bearer tokens, which the post says avoids per-request signature verification at high API volumes.
The same post says DBSC covers browser session cookies, and that multi-agent delegation should use Google Cloud Secure Token Service, because oauth2.googleapis.com does not support RFC 8693 token exchange.
Written by AI from the articles below · updated Oct 15, 3:08 PM ET
Check the sources:
Article timeline
The articles in this story. Times are ET.
- Google Developers BlogOfficialGoogle adds DPoP support to its OAuth platform for securing refresh tokens
AIGoogle's OAuth Platform now supports DPoP, an RFC 9449 profile that binds tokens to a client-held key pair, for refresh tokens only. Access tokens stay standard Bearer tokens to avoid per-request signature verification at high API volumes. The article also says DBSC covers browser session cookies, and that multi-agent delegation should use Google Cloud Secure Token Service because oauth2.googleapis.com does not support RFC 8693 token exchange.
Heat trend
Not enough continuous observations to show a trend yet.