---
title: "DPoP"
description: "4 posts about DPoP, summarised, each linking to the original."
---

# DPoP
> 4 posts about DPoP, summarised, each linking to the original.

## Articles

### [Announcing DPoP Support for Google OAuth: Securing Refresh Tokens](https://yomu.fyi/post/announcing-dpop-support-for-google-oauth-securing-refresh-tokens.md)
- Company: [Google](https://yomu.fyi/company/google.md)
- Author: Sergei Akulich, Brian Daugherty
- Published: Oct 15, 2026
- Type: Announcement

Google announced DPoP (RFC 9449) support for its OAuth platform, specifically binding refresh tokens to a client-generated asymmetric keypair to neutralize token theft and replay attacks from Infostealer malware and AiTM threats. Access tokens remain standard bearer tokens to avoid the per-request asymmetric cryptographic verification overhead on high-QPS APIs like Gmail and Drive, delivering a pragmatic tradeoff between security and performance. The implementation follows RFC 9700 best practices for sender-constrained refresh tokens and is recommended for Backend-for-Frontend (BFF) and Token-Mediating Backend architectures. DPoP operates at the HTTP header level, making it resilient in multi-hop environments such as Model Context Protocol (MCP) agent chains, though multi-agent delegation requires Google Cloud Secure Token Service (STS) to preserve key isolation. Complementary protections against cookie theft are offered by Device Bound Session Credentials (DBSC), which cryptographically binds browser session cookies to device hardware for a defense-in-depth strategy.


### [How to Build Secure Okta Node.js Integrations with DPoP](https://yomu.fyi/post/how-to-build-secure-okta-node-js-integrations-with-dpop.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Ram Gandhi
- Published: Oct 23, 2024
- Type: Tutorial

Okta management API integrations can use a Node.js service app with OAuth 2.0 client credentials, but a bearer access token can be replayed by anyone who obtains it during its one-hour lifetime. The tutorial configures Okta for private\_key\_jwt authentication, grants the okta.users.read scope and Read-only Administrator role, and builds a Node.js service that requests and caches an access token. It then enables Demonstrating Proof of Possession (DPoP), handles an initial use\_dpop\_nonce response by retrying the token request with a nonce-bound proof, and generates a fresh proof for each API call. Each request binds the proof to the access token through the SHA-256-based ath value and uses DPoP rather than Bearer authorization. The demonstrated service successfully lists users through Okta Admin Management API endpoints.


### [Secure OAuth 2.0 Access Tokens with Proofs of Possession](https://yomu.fyi/post/secure-oauth-2-0-access-tokens-with-proofs-of-possession.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Alisa Duncan
- Published: Sep 10, 2024
- Type: Tutorial

Bearer access tokens grant whoever possesses them access, making theft especially risky for public clients such as SPAs and mobile apps. DPoP, an OAuth 2.0 extension, binds a token to a client’s public key and uses signed proofs so authorization and resource servers can verify requests. The tutorial migrates an Angular single-page application from bearer tokens to DPoP while building on the Authorization Code flow, inspecting token exchanges, request headers, replay protection, and calls to Okta’s APIs; React and Vue variants are also noted. It recommends IndexedDB with non-exportable WebCrypto keys, cleanup during sign-in, and browser capability checks, while noting that the preserved setup instructions no longer work exactly as written after Okta’s May 2025 account changes.


### [Elevate Access Token Security by Demonstrating Proof](https://yomu.fyi/post/elevate-access-token-security-by-demonstrating-proof.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Alisa Duncan
- Published: Sep 5, 2024
- Type: Tutorial

Bearer access tokens let anyone holding a valid token call a resource server, creating risk when tokens are stolen. Existing protections include secure coding, short expiration, and origin restrictions, but the post presents OAuth 2.0 Demonstrating Proof of Possession (DPoP) as a way to bind tokens to client-generated cryptographic proof. The client creates a JWT containing request details, issue time, unique identifier, and public key; the authorization server uses it to bind a key hash and request information to the returned token. For sensitive requests, authorization or resource servers can require a nonce, prompting a new proof and limiting lifetime and replay risk. Resource servers must validate both proof and access token properties, with a vetted OAuth library recommended.