OAuth

Technical terms
About 1 min read

An open standard protocol that securely delegates access permissions for specific data or features to third-party services without directly sharing passwords. It primarily provides a token-based authorization framework.

Also known as
OAuth 2.0OAuth

Detailed explanation

OAuth is a security framework that manages permissions so that specific applications can access a user's resources (such as emails or calendars) while protecting the user's account credentials. Currently, OAuth 2.0 is the standard, and the recently enhanced security version, 2.1, is under discussion. It is essential when AI agents read data or perform tasks on behalf of users. It focuses on authorization rather than simple authentication, and reduces the risk of security incidents by allowing limited access only to the necessary data through scope configuration.

Why it matters in tool selection

When choosing AI tools or workflow automation tools, OAuth support is key to security. While the API Key method carries a high risk of exposing all account permissions if the key is leaked, OAuth is much safer because it allows you to restrict the scope of permissions to options like 'read-only' and revoke access for specific apps individually at any time.

What to check

  • Does it request only the necessary scopes in accordance with the principle of least privilege?
  • Does it support the latest security extensions, such as PKCE (Proof Key for Code Exchange)?
  • Does it provide an administrative dashboard to revoke authorization?

Example

When a user connects their Google Calendar to an automation tool like 'Zapier', a Google consent screen appears instead of requiring them to enter their Google password. If they only allow the 'view calendar' permission, Zapier can retrieve calendar data using only an 'access token' without needing the password.

Confusing Terms

OpenID Connect (OIDC)

A layer built on top of OAuth 2.0, designed to verify the user's identity (authentication) as well as authorization.

SAML

An XML-based standard primarily used for Single Sign-On (SSO) between internal enterprise systems. In mobile and modern API environments, OAuth is preferred.

Related terms

SSO