In plain language
Instead of handing an app a password, a user approves specific access and the app receives revocable tokens.
Example
A user authorizes an automation platform to create calendar events without sharing their calendar password.
Related terms
Api Key · Integration · API
Common misconception
OAuth is not authentication by itself and “Sign in with” behavior requires an identity layer such as OpenID Connect.
Implementation guidance
Use authorization code flow with PKCE where applicable, request minimum scopes, validate state, store tokens securely, and handle refresh and revocation.