What is OAuth?
OAuth is a login handoff. You approve an app in Google, Microsoft, or another account, and that app gets a limited token. You do not give the app your password.
In plain English
The screen that says 'Zapier wants to read your calendar' is OAuth. You can revoke it later in the Google or Microsoft security page. It is safer than an API key you copy, but the scope still matters. 'Read calendar' is not 'send mail as me.' Read the scope before you hit allow. The consent screen is the contract, and most people click through it. Read the verbs. Read mail is not send mail. Access files is not access every shared drive. If the screen is a wall of scopes you do not recognize, cancel and ask the vendor which line does the job you actually want. Connect a test account first if you have one. Reconnect on purpose once a year, or when the vendor emails about new access, and read the screen again instead of assuming it matches last time. Screenshot the allowed verbs, not the secret. File that screenshot beside the SOP.
How an owner would use it
Connect with the company account, not a personal Gmail. Review the list of connected apps twice a year and when someone leaves. Remove anything you do not recognize.
Common mistakes
Clicking Allow on a personal Gmail because it was faster ties the business to someone's private account. The other miss is not reading the scope. A screen that asks to send mail is not a calendar lookup. OAuth is safer than pasting a password, and it is still access. Review connected apps when people leave. If you cannot find the disconnect button, you do not understand the connection yet.
A worked example
A yoga studio
The schedule app, not the owner's Gmail
This is an illustration, not a customer result. The studio connects class scheduling with OAuth on the studio Google account, and only for the class calendar. When a front-desk sub stops working Fridays, the owner removes that app from the account's security page.
Related terms
Prompts and guides
Questions owners ask
What is OAuth?
OAuth is the standard that lets you grant an app limited access to another account without sharing your password. You can revoke that grant later.
How do I use OAuth in a small business?
Approve connections from the company account, check the permission scope, and remove old apps when people or vendors leave.
Why not just share the password?
A shared password cannot be limited to one calendar, and you cannot take it back without changing the password for everyone. OAuth lets you revoke one app and leave the account alone.
Product guides are on AI apps for business.