OAuth

OAuth is an open standard that lets a user grant one application limited access to their data in another application without sharing their password. It is the technology behind the familiar "sign in with Google" or "connect your account" buttons, where you allow a new app to see certain information from an existing service without ever typing your password into that new app. Instead of handing over your credentials, you authorize a scoped, revocable permission, and the app receives a token that lets it act on your behalf within clearly defined limits.

Mechanically, OAuth works through a flow of redirects and tokens. When you choose to connect an app to a service, the app sends you to that service's own login page, where you authenticate directly with the service and are shown exactly what access is being requested, such as reading your profile or your contacts. If you approve, the service sends the app back a short-lived authorization code, which the app exchanges behind the scenes for an access token. The app then includes that token on its requests to the service's API, and the service honors only the specific permissions, called scopes, that you granted. Because the app never sees your password, and because tokens can expire and be revoked, you retain control and can cut off access at any time.

The name is short for "open authorization." The standard was first published in 2007, and the widely adopted revision, OAuth 2.0, arrived in 2012 to define a more flexible framework for this kind of delegated access. It emerged from a clear need: as web services multiplied, people wanted to let apps work together without the reckless practice of giving one company the password to another.

For a business, OAuth matters on two fronts. As a consumer of it, a business can offer smooth social sign-in and integrations that reduce sign-up friction and let its product connect to the tools customers already use, which improves adoption and convenience. As a provider of it, a business that exposes an API can let third parties build on its platform safely, granting scoped access without ever exposing user passwords. In both directions, OAuth increases security while enabling the connected, integrated experiences that users expect. It keeps passwords in one place and turns access into something granular and revocable.

The nuances and common mistakes deserve care. OAuth is fundamentally about authorization, delegated access, and it is often mistakenly treated as a complete login system on its own, which is why layers built on top of it exist to handle identity properly. Misconfiguring scopes so that an app requests far more access than it needs, mishandling or leaking tokens, and failing to validate the redirect steps are all real security risks. Implementing OAuth from scratch is notoriously tricky, so using vetted libraries and providers is strongly advised. OAuth relates closely to authentication and authorization as the concepts it operationalizes, and to JWTs, which are frequently used as the format for the tokens it issues. Understood correctly, OAuth is the practical backbone of secure, password-free sharing between the many services people use every day.