FRENES

Glossary · Security and risks

OAuth

OAuth is an authorization framework that lets an application obtain limited access to another service. In a common user workflow, you can allow an AI agent to read your calendar without giving it your password, using access tokens issued through the calendar service’s authorization system.

OAuth: the explanation

In a common authorization flow, the application directs you to the service holding your information. You sign in there if necessary and review the requested permissions. After authorization, the application receives a way to obtain a token that it presents when requesting permitted operations. Your password stays with the service rather than being handed to the application. The delegation framework is specified here: https://www.rfc-editor.org/rfc/rfc6749.html. The exact steps and safeguards depend on the application type and implementation.

OAuth helps applications connect to services without sharing your primary account credentials. An agent might use that connection to read files or add calendar entries under permissions defined by the service. These permissions are often described as scopes. Their granularity varies: a scope may allow reading, editing, or access to a broader resource collection. You therefore need to read the actual consent screen instead of judging the connection only by the application’s name or stated purpose.

OAuth deals with authorization and does not by itself define a complete sign-in system that establishes your identity to the application. OpenID Connect adds an identity layer for that purpose. Access tokens remain sensitive even when your password is never shared. Some connections can also be renewed without asking you again, depending on the granted permissions. You should therefore know where connected applications are listed and how to revoke access when an integration is no longer needed.

A concrete example

You connect an assistant to your calendar to help plan your week. The calendar service displays the requested permissions, which allow reading events but not changing them. The assistant can identify open periods and suggest a schedule. Creating an actual appointment would require suitable additional access. When you stop using the assistant, you remove the connection and check the calendar service’s settings to confirm that the authorization has been revoked.

Why it matters

OAuth matters because a connected agent may access personal or workplace resources. Before approving a connection, compare the requested permissions with the task you expect it to perform. Check whether access can persist, whether organizational policies apply, and how to disconnect the application. OAuth can avoid sharing your password with that application, but it does not establish that the application is trustworthy or will handle accessible information appropriately.

Common misconceptions

  • An OAuth sign-in button does not mean the application receives your password: the service can issue separate tokens whose permissions and lifetime depend on the authorization granted and the way the integration has been configured.
  • OAuth access is not automatically narrow or harmless: an application may request broad permissions, so you still need to review their scope even when the consent screen is hosted by a familiar and legitimate service.

Related terms: security and risks

guardrails
Guardrails are measures that constrain how an AI system behaves and which actions it can perform.
sandbox
A sandbox is an execution environment that restricts what a program can access or change beyond its assigned boundaries.
least privilege
Least privilege is a security principle that gives a system only the access needed for its assigned task.
prompt injection
Prompt injection is an attempt to redirect an AI system through instructions placed in material it processes.
API key
An API key is an identifier that software sends when accessing certain online services.

Where this site covers it

The term appears on 37 pages of this site. A few of them:

Go further

Frequently asked questions

Does OAuth establish my identity?

OAuth primarily addresses authorization. A complementary protocol such as OpenID Connect can provide verifiable identity information for signing in. Interfaces sometimes combine these functions under one login button, which can make the distinction less obvious to users.

Can I withdraw permission?

Services commonly provide settings for connected applications where you can revoke access. The available controls depend on the service. Revocation does not automatically erase information that the application had already copied before the connection was ended.

Does access expire automatically?

An access token may expire, but an application can sometimes obtain another through a refresh mechanism. The expiry of one token therefore does not necessarily mean that the overall application connection has ended or needs your approval again.

Neutrality. No affiliate links. No vendor pays to be reviewed, rated or ranked. Reviews are directed by François Chollet, neutral and factual, and every data point is dated and sourced. How we score