What Is OAuth?
OAuth is the standard for delegated access: one service gets a limited, revocable key to another – never your password. You recognize it from logging in with Google and letting an app read your calendar. The key is called a token, and its scope defines the range. Unlike SSO, OAuth grants access, not identity.
OAuth is the technology behind one of the most everyday things online: logging in with an account you already have, or letting an app fetch something from another service. Even though you use it all the time, it’s rarely explained what actually happens. The core idea is simple and rather clever: granting access without handing over the password. Here’s how it works.
The everyday example you recognize
You’ve probably encountered an app that asks “do you want to log in with Google?” or “this app wants access to your calendar.” You hit approve, and the app can then read your calendar – without you ever giving it your Google password.
That’s OAuth at work. Instead of handing out the password, which would give the app full access to everything in your account, you give it a limited, scoped access to exactly what you’ve approved. The app can read your calendar, but not read your email, not change your settings, not anything else. And if you change your mind, you can revoke the access without having to change your password.
The point is delegation. You delegate a limited right to a service, on your behalf, without giving away the keys to the whole account. That’s why OAuth is called the standard for delegated access.
Token: the key instead of the password
How does granting access without a password actually work? Through a token. When you approve, the requesting service gets a token – think of it as a temporary key that proves you’ve given permission. The service then uses that key, not your password, every time it needs to access what you’ve approved.
The difference is crucial. A token can be limited in what it unlocks and can be revoked at any time, while a password is the master key to everything. If a token leaks, the damage is contained; it only unlocks the small piece it was allowed to. Your password stays secret, known only to you and the service it belongs to.
Scope: how much the key unlocks
The other building block is scope, the range. A scope defines exactly what a token is allowed to do. “Read the calendar” is one scope. “Send email on your behalf” would be another. When an app requests access, it’s scopes it’s asking for, and that’s why you sometimes see a list of what the app wants to access before you approve.
Together, the token and scope mean a service gets exactly the access you’ve given it – no more, no less. The key (token) only unlocks the doors you’ve pointed out (scope). It’s this fine-grained control that makes OAuth both secure and useful: you can let a service in a little way without opening the whole house.
Not the same thing as SSO
OAuth is often confused with single sign-on, SSO, since both show up in login flows. But they answer different questions.
OAuth is about access: granting a service permission to do something with data held by another. SSO is about identity: proving who you are, so a single login is enough for several systems. In short, OAuth grants access, not identity. The fact that they meet in practice – login is sometimes built on top of OAuth – makes them blend together, but at their core they’re two separate things: one opens a door, the other says who you are.
One way to keep them apart: when an app asks to read your calendar, that’s an access matter, and OAuth fits there. When you log in to a tool and the company’s login vouches that you’re you, so you don’t need a separate password just there, that’s an identity matter, and that’s where SSO belongs. The same approval box can happen to look identical in both cases, but the question behind it differs. Understanding that difference also makes it easier to understand what a vendor is actually offering when they talk about “log in with.”
At Weapp we build integrations that use OAuth correctly, so access between services is both secure and scoped. Want to connect services in a safe way? Check out our services or get in touch.
Frequently asked questions
What does OAuth stand for and what does it do?
OAuth comes from open authorization. It's a standard for delegated access: letting a service get access to part of another service's data on your behalf, without you handing over your password. Instead, the service gets a limited key that only grants the access you've approved, and that you can revoke.
Why is OAuth safer than handing out your password?
Because you never give away the password. Instead of an app getting your full login – and therefore everything – it gets a scoped key that only unlocks what you've approved, for example reading your calendar but not sending email. The key can also be revoked at any time without you having to change your password. The access is limited and reversible.
What are a token and a scope?
A token is the key the service gets instead of your password – proof that you've given permission. A scope is the boundary on what that key can do, its range: read your calendar, but not change it. Together they mean a service gets exactly the access you've approved, no more and no less, and no password changes hands.
What's the difference between OAuth and SSO?
OAuth is about access: granting a service permission to do something with data held by another. SSO is about identity: proving who you are so you can log in to several systems with one login. They're often confused because they meet in login flows, but at their core OAuth grants access, while SSO establishes identity. They're two different questions.
Do I encounter OAuth in everyday life?
Constantly, usually without thinking about it. Every time you log in somewhere with your Google or Facebook account, or approve an app reading something from another service, it's usually OAuth working in the background. The box where you see what the app is requesting access to and hit approve is OAuth in practice – delegated, scoped access you control yourself.