Device-bound session credentials (DBSC)

Device-bound session credentials are a way for a website to make sure a logged-in session stays on the device that created it. When a session starts, the browser generates a key pair and stores the private key in the device's secure hardware, such as a TPM or secure enclave, where software cannot read it out. The session cookie becomes short-lived, and to refresh it the site sends a challenge that the browser can only answer by signing with that private key. A valid session therefore requires both the cookie and possession of the device it was bound to.

The immediate target is cookie theft: infostealer malware that copies session cookies off a machine finds them useless elsewhere, because the stolen cookie cannot answer the refresh challenge without the key that stayed behind. The same property has a large side effect for automation. Any product that asks a user for their session cookie and then replays it from cloud servers depends on that exported cookie staying valid. Under device binding it does not: the cookie is separated from its key the moment it leaves the device, and the session lapses at the next refresh. This is an architectural change rather than a detection contest, because it removes the ability to use a session away from its origin device regardless of how convincingly the traffic is dressed up.

The approach that survives is to keep the session where it was created and drive the browser in place. Oculr runs each account in a persistent, isolated profile that keeps its cookies, storage and identity together on hardware the account owner controls, so refresh challenges are answered by the browser that owns the session rather than by a copy of the cookie somewhere else. Automation platforms integrate over the local API, MCP tools or raw CDP without ever exporting the credential.