Google Adds DPoP Security to OAuth Refresh Tokens
The update mitigates token theft by binding refresh tokens to client-side cryptographic keys without slowing API access.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you trust the current security measures used to protect your online accounts and personal sessions?
Google has updated its OAuth platform to support Demonstrating Proof-of-Possession (DPoP) for refresh tokens. This security implementation, which remains in an announced stage, aims to mitigate token theft and replay attacks by binding tokens to unique client-generated cryptographic keys.
Why it matters
By applying DPoP to refresh tokens, Google targets the primary vector for persistent online impersonation without imposing the heavy computational overhead required to secure every individual access token.
DPoP requires clients to generate an asymmetric key pair, manage nonces, and append proof-of-possession JSON Web Tokens (JWTs) to HTTP headers. This approach provides a cryptographic guarantee that a token is used only by the specific client that initiated the request.
The players
A global technology leader managing search, cloud computing, and identity infrastructure, including the widely used Google OAuth platform.
Web Incubator Community Group
An industry coalition focused on developing new web platform features and improving browser security standards.
The details
DPoP works by binding security tokens to a cryptographic proof tied to a specific client, preventing attackers from using stolen tokens on different hardware. Google has intentionally restricted this to refresh tokens to address the most dangerous forms of impersonation while keeping access tokens as standard Bearer tokens, which avoids the latency of asymmetric verification during every API call. Developers are encouraged to use the Backend-for-Frontend pattern for browser-based apps to further isolate credentials from the client side.
Timeline
Google announced support for DPoP within its OAuth platform on October 29, 2026.
The Tech Race
This move represents an incremental shift toward hardware-backed identity, following the development of Device Bound Session Credentials (DBSC) for browser cookies. By prioritizing refresh tokens, Google is racing to harden long-lived credentials against the common threat of session token theft.
Software developers and identity engineers should begin configuring their OAuth clients to handle DPoP proof generation for refresh tokens. For end users, this shift will improve account security by making stolen sessions useless on unauthorized devices, though the transition depends on individual app integration.
The takeaway
Google is prioritizing the security of refresh tokens to stop persistent identity theft while keeping high-traffic API calls performant. Engineers should track the integration of DPoP and the upcoming DBSC standards as the primary methods for securing long-term application sessions.
Further reading
Learn more about the latest developments in Cybersecurity as platforms evolve to protect against persistent token-based impersonation attacks.
Source note: This article includes information reported by InfoQ.
Live Poll
Do you trust the current security measures used to protect your online accounts and personal sessions?
