OAuth: how do you connect two apps without sharing a password?
Every Allow access to your calendar or Sign in with button you click almost certainly runs on OAuth.
OAuth 2.0 is an authorization framework standardized by the IETF that lets a third-party application get limited access to a web service on its owner's behalf, without ever learning the owner's password. The person approves the access once, and the application receives a token restricted to specific scopes that can be revoked at any time.
In short
- OAuth grants access; it does not replace your password.
- Access tokens are limited to scopes, such as read-only calendar access.
- Access can be withdrawn from the original account whenever you like.
- The reference standard is RFC 6749, published in October 2012.
What does the OAuth 2.0 standard say?
IETF RFC 6749, published in October 2012, describes OAuth 2.0 as a framework that lets a third-party application obtain limited access to an HTTP service, either on behalf of the resource owner through an approval interaction or on its own behalf. It replaced and made obsolete the OAuth 1.0 protocol [1].
oauth.net, which tracks the IETF working group, calls OAuth 2.0 the industry-standard protocol for authorization and notes that OAuth 2.1 is an in-progress effort to consolidate it with common extensions [2]. Keep the word authorization in mind: OAuth governs what an app may do, not who you are.
What happens during an OAuth connection?
- 1
The request
Your scheduling tool wants to read your Google Calendar, so it sends you to Google's sign-in page.
- 2
The approval
You sign in with Google, not inside the tool. Google lists the rights requested, called scopes, and you accept or decline.
- 3
- 4
The refresh
A refresh token lets the tool get a new access token later. Google notes that refresh tokens can expire for various reasons, including user actions or policy settings [3].
How many connections should a small business keep an eye on?
Which mistakes are common?
- Accepting every scope without reading: a tool that only needs to read your calendar has no business deleting your email.
- Typing your Google or Microsoft password into a window that does not belong to that provider.
- Forgetting that a departing employee leaves behind apps authorized under their account.
- Treating OAuth as an identity check when it is an authorization protocol [2].
- Overlooking the personal information that flows this way: Quebec's Law 25 also covers data read by a third-party tool.
Frequently asked questions
Is OAuth secure?
It is safer than sharing a password because access is limited and revocable. Its security still depends on how well it is implemented and on how carefully you review scopes. The IETF also publishes a separate security best current practice for OAuth.
What is the difference between OAuth and Sign in with Google?
OAuth authorizes access to resources. Signing in with a Google account is mainly about identifying you, which involves ID tokens that oauth.net distinguishes from access tokens. Both often appear on the same screen, hence the confusion.
How do I remove an app's access?
Open the security settings of the original account, such as Google or Microsoft, and find the list of third-party apps. Revoke the ones you no longer use. The app then loses its token.
Why does an app keep asking for my approval again?
Its refresh token may have expired or been revoked, for example after a password change or an organizational security policy. The app then has to go through the approval step again.
Is OAuth 1.0 still around?
RFC 6749 made OAuth 1.0 obsolete in 2012. You may still find it in older systems, but new integrations use OAuth 2.0.
Sources
- IETF, RFC 6749 : The OAuth 2.0 Authorization Framework (accessed on October 15, 2026).
- oauth.net, OAuth 2.0 (accessed on October 15, 2026).
- Google for Developers, Using OAuth 2.0 to Access Google APIs (accessed on October 15, 2026).
Read next
What is an API?
What an API is: the contract that lets two pieces of software exchange data. Includes a worked example for a Quebec service SME and common mistakes.
What is SaaS (software as a service)?
What SaaS means, how it differs from installed software, a three-year subscription calculation for a Quebec service SME and the contract traps to avoid.
What is a webhook and what is it for?
A webhook pushes an automatic notice the moment an event happens in a piece of software. How it works, a worked SME example and the security traps to avoid.
Quebec Law 25: what changed for small businesses?
Quebec's Law 25 explained for small service businesses: the person in charge, consent, incidents, automated decisions, penalties and a costed starter checklist.