What is OAuth? Definition for connecting apps

OAuth is a standard that lets one application use your account in another with limited, revocable permission, without you handing over your password.

How it works

Before OAuth, a tool that needed your data from another service often asked for your password and stored it. RFC 6749, the OAuth 2.0 specification published in October 2012, lists the problems: third-party apps had to store credentials, "typically a password in clear-text", got broader access than they needed, and could not be cut off one at a time (RFC 6749).

OAuth replaces the password with an access token. The specification names four roles: the resource owner (you), the client (the app asking for access), the authorization server (which signs you in and issues tokens) and the resource server (the API holding your data). A typical flow:

1. In a chat or booking tool, you click "Connect your CRM".
2. You are sent to the CRM's own sign-in page, so the tool never sees your password.
3. The CRM shows which permissions, called scopes, the tool wants, such as "read and write contacts".
4. You approve, and the tool receives an access token, often with a refresh token to renew it.
5. The tool uses the token to call the CRM's API, within those scopes, until it expires or you revoke it.

The standard has been tightened since 2012. RFC 9700, the OAuth 2.0 security best current practice published in January 2025, says public clients such as browser and mobile apps "MUST use PKCE", an extra check that ties the token to the app that started the flow. It says the older implicit grant should not be used, and that the password grant "MUST NOT be used" (RFC 9700).

Why it matters for your website

Most website tools connect to your CRM, calendar or helpdesk through OAuth. That is good news: you can grant only what is needed and take it back later. A few checks are worth a minute:

• Read the scopes. A lead capture tool needs to create contacts; it rarely needs to delete them.
• Connect with the right account. If a team member connects with a personal login, the integration may stop working when they leave. Use an account the business controls.
• Know where to revoke. Every major platform lists connected apps in its settings.
• Prefer OAuth to pasted API keys where both are offered, because tokens can be scoped and revoked individually.

Example

A marketing manager connects a website chat tool to the company's calendar. The calendar provider's consent screen asks to let the tool "see your free/busy information and create events". She approves with the shared sales calendar account. Six months later the company changes tools; she opens the calendar's connected-apps page, removes the old tool, and its token stops working immediately.

Related terms

• CRM: the system tools most often connect to with OAuth.
• Webhook: how apps notify each other once connected.
• Website widget: embedded tools that may use OAuth behind the scenes.
• Content Security Policy (CSP): another control over what third-party code may do.