OAuth
/ OH-auth /
OAuth is the standard behind every 'Log in with Google' or 'Continue with GitHub' button. Its whole point is letting one app use another without ever seeing your password. You're not handing the new app your Google login — you're asking Google to let it in on your behalf.
The everyday analogy is a hotel key card. Reception (Google) checks your ID once, then gives the app a card that opens just a few specific doors — say, your email address and name — and nothing else. The app never learns your master key, and you can cancel that card at any time without changing your real password.
What the app receives is an access token: a temporary, limited pass. That's the difference worth remembering — OAuth is about granting limited access, not about proving who you are. The password stays with you and the service you trust.
App → Google: "let this user share their email with me?" User clicks "Allow" Google → App: access token (email only, no password)
OAuth in three steps: the app asks, you approve, it gets a limited token — never your password.
OAuth was built for authorization (what an app may access), not identity. The 'log in' part you see is really OpenID Connect, a thin layer added on top of OAuth.