OAuth

OAuth 2.0 is the protocol that lets one application access another service on a user’s behalf without handling the user’s password. The user authorizes the app, and it receives a scoped, revocable access token instead of credentials.

Worked example: “Sign in with Google” or letting an app post to your calendar uses OAuth — you approve specific scopes (read calendar, not delete email) and the app gets a token limited to those. Gotcha: OAuth is for AUTHORIZATION (what an app may do), not authentication (who you are) — adding identity on top is what OpenID Connect does; conflating the two, or requesting overly broad scopes, is the classic OAuth mistake.