Google Rolls Out DPoP Security for OAuth 2.0 Refresh Tokens

Google's OAuth platform now supports Demonstrating Proof-of-Possession (DPoP), a security mechanism that cryptographically binds tokens to client-generated key pairs to defend against token theft and replay attacks.

The vulnerability DPoP addresses#

Traditional OAuth bearer tokens operate under a "find it, use it" model that leaves them exposed to compromise. Infostealer malware (such as RedLine and NodeStealer) and adversary-in-the-middle attacks can intercept tokens in transit or steal them from compromised systems. Once obtained, these credentials can be replayed by anyone who possesses them—the original client can't tell legitimate use from fraudulent reuse.

How DPoP strengthens token security#

DPoP ties each token to an asymmetric cryptographic key pair that the client controls. When a stolen token is used, the attacker lacks the corresponding private key needed to prove possession, making the token useless for replay. Google's implementation applies DPoP to refresh tokens specifically—the long-lived credentials that represent the highest risk for persistent account compromise. Access tokens, which expire quickly, remain standard Bearer tokens to avoid the computational cost of cryptographic verification on every API request.

Client-side implementation complexity#

Deploying DPoP requires developers to handle several moving pieces: generating and managing cryptographic keys, managing timestamps and cryptographic nonces, constructing proper HTTP headers, and creating the DPoP proof JWTs that accompany requests. This operational overhead is the tradeoff for stronger token binding.

Limitations and complementary defenses#

DPoP protects API tokens but leaves browser session cookies vulnerable to the same infostealer threats. To close that gap, Google and the Web Incubator Community Group (WICG) are developing Device Bound Session Credentials (DBSC), which cryptographically anchors session cookies to device hardware such as TPM modules. Together, these mechanisms create layered defense across both API and web contexts.