--- format: "aidr-story-markdown/v1" id: "68075b827dd9c2b096a5b64cc7992ca4d51e4dd946026674a92ca506b798d39e" canonical_url: "https://aidr.today/68075b82?lang=en" title: "Announcing DPoP Support for Google OAuth: Securing Refresh Tokens" lang: "en" requested_lang: "en" available_langs: ["en","vi"] translation_fallback: null fallback_fields: [] published_at: "2026-10-19T19:12:47.000Z" category: "Tools" topics: ["google","safety","devtools"] source_urls: ["https://developers.googleblog.com/announcing-dpop-support-for-google-oauth-securing-refresh-tokens/"] summary: "Google OAuth Platform now supports DPoP (Demonstrating Proof-of-Possession) to sender-constrain refresh tokens, neutralizing Infostealer malware and adversary-in-the-middle attacks. By cryptographically binding long-lived refresh tokens while maintaining short-lived access tokens as standard Bearer tokens, developers achieve robust credential security without incurring high-QPS API performance overhead. Developers integrating multi-agent or Model Context Protocol (MCP) workloads can use Google Cloud Secure Token Service (STS) to handle secure token delegation across agent chains." --- # Announcing DPoP Support for Google OAuth: Securing Refresh Tokens > [Open the canonical story]() **Published:** 2026-10-19T19:12:47.000Z **Category:** Tools **Topics:** google, safety, devtools ## Summary Google OAuth Platform now supports DPoP \(Demonstrating Proof\-of\-Possession\) to sender\-constrain refresh tokens, neutralizing Infostealer malware and adversary\-in\-the\-middle attacks\. By cryptographically binding long\-lived refresh tokens while maintaining short\-lived access tokens as standard Bearer tokens, developers achieve robust credential security without incurring high\-QPS API performance overhead\. Developers integrating multi\-agent or Model Context Protocol \(MCP\) workloads can use Google Cloud Secure Token Service \(STS\) to handle secure token delegation across agent chains\. ## Sources - [Story source]()