Skip to content

OAuth

OAuth is an authorization framework that lets an application receive limited access to another service without receiving the user's primary account credentials.

OAuth is an authorization framework that allows one application to receive limited access to another service without requiring the user to give that application their primary account credentials.

OAuth is commonly used for connected applications and “Connect your account” workflows.

What It Means in Practice

Imagine a reporting tool wants access to a user's external account.

Instead of asking:

Give me your password.

the reporting tool sends the user to the external service.

The user signs in there and approves specific access.

The reporting tool receives a token representing that authorization.

What OAuth Solves

OAuth helps separate:

  • User credentials
  • Third-party applications
  • Granted permissions

An application may be authorized to:

  • Read calendar events
  • Access profile information
  • Read analytics data
  • Create records
  • Perform other limited actions

without receiving the user's password.

The formal OAuth 2.0 framework is standardized through RFC 6749.

OAuth vs. Authentication

OAuth is fundamentally an authorization framework.

It answers:

What has this application been granted permission to access?

Authentication answers:

Who is this user or application?

OAuth can be part of a broader login system, but OAuth itself should not simply be treated as a synonym for authentication.

Tokens and Scopes

OAuth systems commonly issue access tokens.

Those tokens may be associated with scopes describing what the integration can do.

For example:

read:contacts
write:contacts

A useful integration should request only the scopes it actually requires.

Why It Matters

OAuth allows users or administrators to:

  • Approve an integration
  • Limit its access
  • Revoke it later
  • Avoid sharing primary credentials

This makes it useful for SaaS integrations between independent platforms.

Common Problems

Common problems include:

  • Requesting excessive scopes
  • Tokens stored insecurely
  • Refresh tokens mishandled
  • Integration access never revoked
  • Developers assuming OAuth means the user is authenticated
  • Redirect configuration errors
  • Several accounts connected without clear ownership

How to Improve

Use the provider's supported OAuth flow.

Request only necessary scopes, protect tokens, document which organizational account authorized the integration, and make revocation possible.