Build key-bound refresh tokens with clear security rules.
What it does
Guide implementation and debugging of key-bound refresh tokens and DPoP proofs for Google's OAuth platform.
When to use it
Use when configuring non-extractable P-256 keys, generating proofs for code exchange or refresh, or handling Google's nonce challenges; exclude unconstrained OAuth and service-account authentication.
How to use it
It changes how the agent implements and refactors DPoP modules by imposing cryptographic invariants, public exports, and claim-derivation rules.
What you provide
- An existing project
Latest review
What you need · 0
No setup requirements listed.
Access · 0
No additional actions listed.