Unverified50% confidenceFactExact time
The standard DPoP specification (RFC 9449) covers both access tokens and refresh tokens, whereas Google's current choice is to mandate binding only for refresh tokens, with access tokens still being Bearer.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/20/2026
First Seen
Valid until: 1/18/2027
Sources
Related Entities
Related Claims
UnverifiedGoogle recently introduced a DPoP (Demonstrating Proof of Possession) binding mechanism for OAuth refresh tokens, binding refresh tokens to client keys while access tokens remain in Bearer form.77% similarUnverifiedGoogle's DPoP support targets clients that can securely hold private keys, such as server-side applications and native applications (using secure storage); for public clients that cannot securely store keys (such as pure browser-side applications), DPoP's applicability is limited.66% similarUnverifiedThe agent exchanges the authorization code for an access token at the token endpoint, and after the token expires, it can use a Refresh Token to obtain a new access token without requiring the user to authorize again.62% similarUnverifiedUsing disposable email addresses to register accounts in bulk to circumvent payment restrictions may violate Google's Terms of Service and carries the risk of account suspension.62% similarUnverifiedGoogle Authenticator adopts the RFC 6238 standard (TOTP).62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1076446API
curl https://kongchang.com/api/v1/knowledge/claims/1076446MCP
get_claim(id=1076446)