NEWS BRIEF
What happened
Google’s OAuth Platform has added DPoP binding for refresh tokens. Google describes cryptographic binding to a client-held key, while short-lived access tokens remain bearer tokens in its implementation. The announcement also discusses key management and delegation considerations for connected applications and agent workflows.
What the announcement does not establish
This does not protect every credential or replace application authorization. In particular, the stated implementation boundary matters: refresh-token binding should not be confused with universal binding of access tokens or browser session cookies.
Primary source: Google Developers: original announcement (2026-10-15). Sources checked November 3, 2026.