What is OAuth?
The short answer
OAuth is a system that lets you log in to one app or website using an account you already have (like Google or Facebook) without giving that app your password.
How it works
You’ve probably seen buttons like “Sign in with Google” or “Continue with Apple.” That’s OAuth in action. Here’s what happens behind the scenes:
- You click “Sign in with Google” on a website or app.
- You’re redirected to Google, where you log in directly with Google (not the app).
- Google asks your permission to share basic info (like your name and email) with the app.
- Google sends the app a token — a temporary key that proves you approved access.
- The app uses that token to verify who you are, without ever seeing your password.
The important part: your password stays with Google. The app only gets a limited token.
Why it matters
- Fewer passwords to remember — you don’t need to create a new account for every app
- Better security — apps never see or store your actual password
- Easy to revoke — you can disconnect an app from your Google or Facebook settings at any time without changing your password
- Limited access — you control what information the app can see
When should you worry?
OAuth itself is safe and widely used, but keep a few things in mind:
- Check what permissions an app is requesting. If a simple quiz app wants access to your contacts and emails, that’s a red flag.
- Only sign in through official prompts. If a “Sign in with Google” button takes you to a suspicious-looking page, don’t enter your credentials.
- Review your connected apps regularly. In your Google, Facebook, or Apple account settings, you can see which apps have access and remove ones you no longer use.
OAuth vs. giving out your password
Think of it like a hotel key card. Instead of giving a guest a copy of the master key to the building, you give them a card that only opens their room and expires when they check out. OAuth works the same way — apps get limited, temporary access instead of your full credentials.