# OAuth: how do you connect two apps without sharing a password?

> OAuth lets you connect two apps without handing over your password. How tokens and scopes work, a Quebec SME example and the mistakes to avoid.

Updated on October 15, 2026 · https://app.pilotiko.com/en/glossary/oauth

OAuth 2.0 is an authorization framework standardized by the IETF that lets a third-party application get limited access to a web service on its owner's behalf, without ever learning the owner's password. The person approves the access once, and the application receives a token restricted to specific scopes that can be revoked at any time.

## In short
- OAuth grants access; it does not replace your password.
- Access tokens are limited to scopes, such as read-only calendar access.
- Access can be withdrawn from the original account whenever you like.
- The reference standard is RFC 6749, published in October 2012.

## What does the OAuth 2.0 standard say?

IETF RFC 6749, published in October 2012, describes OAuth 2.0 as a framework that lets a third-party application obtain limited access to an HTTP service, either on behalf of the resource owner through an approval interaction or on its own behalf. It replaced and made obsolete the OAuth 1.0 protocol [1].

oauth.net, which tracks the IETF working group, calls OAuth 2.0 the industry-standard protocol for **authorization** and notes that OAuth 2.1 is an in-progress effort to consolidate it with common extensions [2]. Keep the word authorization in mind: OAuth governs what an app may do, not who you are.

## What happens during an OAuth connection?

1. **The request** — Your scheduling tool wants to read your Google Calendar, so it sends you to Google's sign-in page.
2. **The approval** — You sign in with Google, not inside the tool. Google lists the rights requested, called scopes, and you accept or decline.
3. **The token** — The tool receives an access token limited to those scopes and uses it to call Google's [API](https://app.pilotiko.com/en/glossary/api) [3].
4. **The refresh** — A refresh token lets the tool get a new access token later. Google notes that refresh tokens can expire for various reasons, including user actions or policy settings [3].

## How is OAuth different from an API key or a shared password?

| Method | What the tool receives | How you take access back |
|---|---|---|
| Shared password | All your rights, with no limits | Change the password everywhere |
| API key | Whatever rights the key carries, often broad | Delete the key at the provider |
| OAuth | A token limited to the approved scopes | Revoke the app in the original account |

## How many connections should a small business keep an eye on?

**Example: a 7-person renovation company in Longueuil**

Assumption: the team uses an online calendar, accounting software, a [quote](https://app.pilotiko.com/en/glossary/quote) tool and email, several of them linked through OAuth.

- Staff accounts with access to the tools : 7
- Third-party apps authorized per account (hypothetical average) : 3
- Authorizations to review (7 × 3) : 21
- Review time per authorization : 2 min
- Full review, twice a year : 84 min a year
- **= Under an hour and a half a year to remove access that is no longer needed, including former vendors and departed staff.**

## Which mistakes are common?

- Accepting every scope without reading: a tool that only needs to read your calendar has no business deleting your email.
- Typing your Google or Microsoft password into a window that does not belong to that provider.
- Forgetting that a departing employee leaves behind apps authorized under their account.
- Treating OAuth as an identity check when it is an authorization protocol [2].
- Overlooking the personal information that flows this way: [Quebec's Law 25](https://app.pilotiko.com/en/glossary/quebec-law-25) also covers data read by a third-party tool.

## What about Pilotiko?

Pilotiko's capability register does not describe OAuth connections to other services, so we do not present any here. To see other ways tools exchange data, read the [webhook](https://app.pilotiko.com/en/glossary/webhook) and [SaaS](https://app.pilotiko.com/en/glossary/saas) entries.

## Frequently asked questions

### Is OAuth secure?

It is safer than sharing a password because access is limited and revocable. Its security still depends on how well it is implemented and on how carefully you review scopes. The IETF also publishes a separate security best current practice for OAuth.

### What is the difference between OAuth and Sign in with Google?

OAuth authorizes access to resources. Signing in with a Google account is mainly about identifying you, which involves ID tokens that oauth.net distinguishes from access tokens. Both often appear on the same screen, hence the confusion.

### How do I remove an app's access?

Open the security settings of the original account, such as Google or Microsoft, and find the list of third-party apps. Revoke the ones you no longer use. The app then loses its token.

### Why does an app keep asking for my approval again?

Its refresh token may have expired or been revoked, for example after a password change or an organizational security policy. The app then has to go through the approval step again.

### Is OAuth 1.0 still around?

RFC 6749 made OAuth 1.0 obsolete in 2012. You may still find it in older systems, but new integrations use OAuth 2.0.

## Sources

1. IETF, « RFC 6749 : The OAuth 2.0 Authorization Framework », https://datatracker.ietf.org/doc/html/rfc6749 (accessed on 2026-10-15)
2. oauth.net, « OAuth 2.0 », https://oauth.net/2/ (accessed on 2026-10-15)
3. Google for Developers, « Using OAuth 2.0 to Access Google APIs », https://developers.google.com/identity/protocols/oauth2 (accessed on 2026-10-15)