IT Glossary
What is OAuth?
The standard by which you allow an application to access data in your account at another service, without ever giving it your password.
The worst sentence in software integration is please give us your password for that other system. OAuth exists so that nobody has to say it. Think of the valet key that starts a car but will not open the boot: the owner grants limited access without handing over full control. OAuth brings that principle to the internet. When an accounting application wants to read your bank statements, you never give it your banking password; instead the bank asks you to confirm, then issues the application a ticket — a token — valid only for statements, only for a limited period, and revocable at any moment from your side. Your password never leaves the bank. The same standard sits underneath every Continue with Google button, open banking, and most integrations between modern services. For a company the standard matters in both directions: your own products can request access to customer data without ever touching their passwords, which removes an enormous legal risk, and when buying software, a vendor who asks for your account password instead of offering an OAuth flow has just advertised their real security level free of charge.
Let’s talk about your project
Message us on WhatsApp or send an email — you talk directly to a developer.
office@northdan.com · +40 752 070 247
Why it matters for your business
Customer passwords never pass through your system
Your application receives only tokens with limited rights — a breach on your side does not expose customers’ Google, banking or Microsoft passwords.
Exactly as much access as needed, for as long as needed
The token carries precise permissions, such as read statements only or send email only, and expires by itself — the damage any incident can do is capped by construction.
Revocation without changing passwords
A customer withdraws an application’s access with one click from their own account — no password change, and no impact on the other connected services.
Frequently asked questions
Are OAuth and single sign-on the same thing?
No. OAuth answers what an application is allowed to do on my behalf, which is authorization, while single sign-on answers who I am, which is authentication. The Continue with Google button combines both, using OpenID Connect — an identity layer built on top of OAuth 2.0 rather than a competitor to it.
Which version of OAuth is used today?
OAuth 2.0, the standard published in 2012, together with its modern security extensions, notably PKCE, which is mandatory for mobile applications and single-page apps. Version 2.1 consolidates those practices into one document. OAuth 1.0 is of historical interest only and should never appear in a new integration.
What happens if an OAuth token is stolen?
An attacker can use only the permissions carried by that token, and only until it expires — typically minutes or hours rather than months. That is precisely why short-lived tokens plus controlled renewal through refresh tokens is the correct configuration, rather than eternal tokens issued so that nobody ever has to log in again.
Let’s talk about your project
Message us on WhatsApp or send an email — you talk directly to a developer.
office@northdan.com · +40 752 070 247