OAuth

OAuth is an open standard for delegated authorization that lets a user grant an application limited access to their account on another service without handing over a password. In the common OAuth 2.0 flow, the application redirects the user to the provider, the user signs in there and approves a specific set of permissions called scopes, and the provider returns an authorization code that the application exchanges for an access token. The application then calls the provider's API with that token. Because the token is scoped, expiring, and revocable from the provider's settings, the exposure is far smaller than sharing credentials. Sign-in with Google, GitHub, and Apple all build on this, and integrations with Slack, Notion, and cloud storage services use the same mechanism. OAuth handles authorization; OpenID Connect is the layer on top that also carries verified identity, which is what social login actually relies on. A frequent confusion is treating an access token as proof of who the user is rather than what the application may do. Tokens must also be stored securely, since a leaked token grants access without any password, and requesting broader scopes than needed enlarges the damage when that happens.