“Sign in with Google.” “Allow this app to access your calendar.” Behind both is a quiet workhorse of the modern web called OAuth. It lets you connect apps and log in without ever handing over your password — a genuinely clever design, with a couple of things worth watching. Our GetMyPassword team explains what OAuth is, how it works, and how to use it safely.
What OAuth is
OAuth is a standard for granting one app limited access to your account on another — without sharing your password. When you let a photo-printing site reach your Google Photos, or sign in to an app “with” your existing account, OAuth is what makes it work. The key idea: the app receives a limited access token, never your actual password.
How it works
The flow is simple from your side. You are sent to the real provider (say, Google) to log in there, then shown exactly what the app is asking for — read your contacts, see your email, and so on. If you approve, the provider hands the app a scoped token good only for those specific things. Your password stays with the provider the whole time.
Why it is good — and what to watch
- No password sharing: the third-party app never sees your actual password.
- Limited and revocable: access is scoped, and you can withdraw it anytime.
- Watch the permissions: only approve what an app truly needs.
- Review connected apps: remove ones you no longer use or recognize.
OAuth lets you lend a key to one room instead of your whole house. The trick is to read what you are granting — and to take the key back from apps you have stopped using.
Protect the account behind it
Because so many apps connect through it, your provider account — Google, Apple, Microsoft — becomes a master key, and OAuth is only as safe as that account. Give it a strong, unique password from our password generator and turn on two-factor authentication. Then periodically review the apps you have connected and revoke anything unfamiliar, so a forgotten grant cannot become a back door.
Frequently asked questions
What is OAuth in simple terms?
It is a standard that lets one app access part of your account on another service without getting your password. The app receives a limited token good only for the specific permissions you approve.
Does an app see my password when I use OAuth?
No. You log in on the real provider’s site, and the app only receives a scoped access token, never your password. This is a key safety benefit of OAuth over typing your credentials into a third-party app.
How do I stay safe when using OAuth?
Only approve the permissions an app truly needs, protect your provider account with a strong password and 2FA, and periodically review your connected apps, revoking any you no longer use or recognize.