What is OAuth?
Quick definition
OAuth is an open standard for secure authorization that allows users to grant applications access to their resources without sharing passwords directly.
OAuth is an authorization protocol that enables secure, delegated access to user resources across different applications. Unlike authentication (which verifies identity), OAuth handles authorization—determining what a user is allowed to do. When you see "Sign in with Google" or "Connect with GitHub," that's OAuth in action. The protocol uses tokens instead of passwords, reducing security risks and limiting exposure of sensitive credentials. OAuth 2.0 is the current standard, widely adopted by major platforms including Google, GitHub, Microsoft, and Facebook.
OAuth operates through a token-based flow where the user is redirected to an authorization server, grants permission for specific scopes (permissions), and receives an access token. This token is then passed to the resource server, which validates it and grants access. OAuth supports multiple grant types for different scenarios: authorization code flow (web apps), client credentials (server-to-server), implicit flow (SPAs), and device flow (IoT devices). The separation of authentication from authorization makes OAuth ideal for distributed systems, microservices, and API integrations.
For developers building AI agents, integrations, and REST APIs, OAuth is essential for secure third-party access. AI agents often need to authenticate users or access external APIs on their behalf—OAuth enables this safely. When building MCP servers or integrations that interact with GitHub, Google Cloud, or other OAuth providers, understanding token management, refresh tokens, and scope limitations is critical. OAuth combined with bearer tokens and TLS encryption provides a robust security layer for agent-to-service communication.
Example
How it shows up in practice
User clicks 'Sign in with GitHub' → Browser redirects to GitHub → User grants permission → GitHub returns access token → Application uses token to access user's repositories without ever knowing the password.
Frequently asked questions
How is OAuth different from API keys?
OAuth tokens are user-delegated and revocable with granular permissions (scopes), while API keys are typically static, application-level credentials. OAuth is better for user authorization; API keys suit service-to-service authentication.
Can OAuth be used for authentication?
OAuth is designed for authorization, not authentication. OpenID Connect (OIDC), built on top of OAuth 2.0, adds authentication. Many platforms combine both for complete identity and access management.
What are OAuth scopes?
Scopes define the permissions an application requests. For example, 'read:user' allows reading user profile data, while 'repo' grants repository access. Users review and approve requested scopes before granting access.
Is OAuth secure for AI agent integrations?
Yes, when used correctly. OAuth eliminates the need to share credentials with agents. Always use HTTPS, validate tokens server-side, implement token expiration, and refresh tokens securely.