Unverified50% confidenceFactExact time
Google recently introduced a DPoP (Demonstrating Proof of Possession) binding mechanism for OAuth refresh tokens, binding refresh tokens to client keys while access tokens remain in Bearer form.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/20/2026
First Seen
Valid until: 1/18/2027
Sources
Related Entities
Related Claims
UnverifiedThe standard DPoP specification (RFC 9449) covers both access tokens and refresh tokens, whereas Google's current choice is to mandate binding only for refresh tokens, with access tokens still being Bearer.77% similarUnverifiedn8n's OAuth credential mechanism allows users to authorize via Google account login, with Google issuing access tokens and n8n automatically managing token refresh and storage in the background.66% similarUnverifiedGoogle's DPoP support targets clients that can securely hold private keys, such as server-side applications and native applications (using secure storage); for public clients that cannot securely store keys (such as pure browser-side applications), DPoP's applicability is limited.66% similarUnverifiedDPoP is a mechanism that binds tokens to client keys, requiring the client to sign each request with a private key to prove possession of the bound key.65% similarUnverifiedCreating OAuth credentials with your own Google Cloud project means the Client ID and Client Secret are under your control, can be revoked and rotated at any time, and allow precise control over which mailboxes can pass testing.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1076440API
curl https://kongchang.com/api/v1/knowledge/claims/1076440MCP
get_claim(id=1076440)