What Is OAuth? "Sign in With Google" and Delegated Access Explained
OAuth is the standard that lets one app access your data in another app without ever seeing your password — it's behind "Sign in with Google" and "Connect your GitHub account". How the OAuth flow works step by step, what scopes and tokens are, OAuth vs OpenID Connect, and the mistakes to avoid.
OAuth is a standard way for one app to get limited access to your data in another app, without your password. Every time you click "Connect your Google Calendar" or "Authorize with GitHub", OAuth is doing the work.
Before OAuth, an app that wanted your calendar would ask for your Google password. That was terrible: the app could do anything as you, forever, and you couldn't take it back without changing your password. OAuth fixes that by handing out tokens instead.
The valet key idea
The classic analogy: some cars come with a valet key that starts the engine but won't open the boot or glovebox. You hand the valet that key, not your main one.
OAuth tokens are valet keys:
- They allow specific things (read your calendar, but not your email).
- They expire.
- You can revoke them at any time from your account settings.
Who's involved
- You — the user who owns the data.
- The client — the app that wants access (say, a scheduling app).
- The authorization server — the service that asks for your permission and issues tokens (Google's login page).
- The resource server — the API that holds your data (Google Calendar's API).
The flow, step by step
- You click "Connect Google Calendar" in the scheduling app.
- The app sends you to Google's login and consent page — not its own.
- Google shows what the app is asking for: "View your calendar events". These permissions are called scopes.
- You approve. Google redirects you back to the app with a short-lived authorization code.
- The app's server exchanges that code (plus its own secret or a PKCE proof) for an access token.
- The app calls Google Calendar's API with the access token.
Your password only ever goes to Google. (OAuth PKCE Explained)
Access tokens and refresh tokens
- Access token: short-lived (often an hour). Sent with each API request.
- Refresh token: longer-lived. Used to get a new access token without asking you again. Must be stored carefully on the server. (Refresh Tokens Explained)
OAuth vs OpenID Connect (and "Sign in with Google")
Strictly, OAuth is about authorization — granting access to data. OpenID Connect (OIDC) is a layer on top that adds authentication — telling the app who you are with an ID token. "Sign in with Google" uses OpenID Connect. In everyday talk, people call the whole thing OAuth. (Authentication vs Authorization, Sign in With Google Explained)
Mistakes to avoid when building with OAuth
- Asking for too many scopes. Users get scared off and you hold more risk than you need.
- Putting the client secret in frontend code. Anyone can read it. Secrets belong on the server.
- Not validating the redirect URL. Attackers can steal codes through open redirects. (Open Redirect)
- Storing tokens in plain text in your database or logs.
- Rolling your own when an auth library or service would do it correctly. (Clerk vs Auth0 vs Supabase Auth)
The summary
- OAuth lets apps access your data in other apps without your password.
- It works with scoped, expiring, revocable tokens.
- OpenID Connect adds "who you are" on top — that's "Sign in with Google".
EasySpawn gives your app a server-side backend where OAuth client secrets and refresh tokens stay out of the browser, with Claude Code there to wire up the flow. See how it works or join the waitlist.
Related: What Is SSO? · What Is a JWT? · Add Login to an AI-Built App · Session vs JWT
Keep reading
What Is SSO (Single Sign-On)? How It Works and When Your App Needs It
Single sign-on lets people log in once with one company account — Google Workspace, Microsoft Entra, Okta — and get into many apps without separate passwords. How SSO works, SAML vs OpenID Connect, why business customers demand it, and how to add it to your own app.
What Is Base64? Encoding Explained (and Why It Isn't Encryption)
Base64 turns any data — images, files, binary keys — into plain text made of 64 safe characters, so it can travel through systems that only handle text. How it works, where you'll see it (data URLs, JWTs, API keys, email), how to encode and decode it, and why it provides zero security.