Skip to content
Get packs

DPoP OAuth Adoption

Implement and debug DPoP-bound refresh tokens for Google OAuth in WebCrypto, Node.js and browser apps

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
1 file

What it does

This skill gives an AI agent detailed rules for adding DPoP (RFC 9449), a mechanism that cryptographically ties an OAuth refresh token to a private key kept on the client, so a stolen token is harder to reuse. It tells the agent how to generate non-extractable P-256 key pairs, build correctly formatted DPoP proof JWTs (including the authorization-code binding and the 64-byte raw ECDSA signature format), and handle Google's use_dpop_nonce retry at the token endpoint. It also explains that single-page apps generally need a backend-for-frontend server to use DPoP with Google APIs.

Great for

  • Developers adding DPoP sender-constraining to an app that uses Google OAuth refresh tokens
  • Engineers debugging DPoP proof signature errors or use_dpop_nonce retry loops
  • Teams deciding whether a browser SPA needs a backend-for-frontend to use DPoP safely

Skip it if

  • Plain OAuth 2.0 flows where refresh tokens are not bound to a client key pair, since the skill itself says it does not apply there
  • Google Cloud IAM or service account authentication, which the skill explicitly excludes
  • Non-developers or anyone without an existing OAuth integration, because the content is low-level cryptographic code guidance

Try asking

  • “Implement generateDPoPKeyPair and exportPublicJWK for my Node.js app using Google OAuth”
  • “Create a DPoP proof for the authorization code exchange at oauth2.googleapis.com/token”
  • “Debug my 400 use_dpop_nonce error and fix the retry loop”
  • “Review my SPA and tell me whether I need a backend-for-frontend for DPoP”
Step-by-step guide: how to use DPoP OAuth AdoptionInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    dpop-adoption.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip dpop-adoption.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip dpop-adoption.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Give the agent your runtime (browser, Node ES module, or legacy Java) so it applies the correct crypto API and signature format rules.
  • Share the exact error message or the token endpoint response when debugging, so the agent can match it to the nonce or DER-versus-raw rules.
  • Review generated code yourself before deploying, since the skill makes strict security claims and the agent still needs to be checked against Google's current documentation.

What's inside

  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.