What is an OAuth?

Instead of an app asking a user for their Gmail or Slack password directly, OAuth has the user authenticate on the actual provider's own login page, choose which specific permissions, or scopes, to grant, and then the provider issues the requesting app a token that's valid only for those permissions. The app never sees the underlying password, and the user can revoke the token at any time from the provider's own settings without changing their password. The original OAuth 1.0 protocol required cryptographic request-signing that made it cumbersome to implement; OAuth 2.0, released in 2012, simplified the flow by relying on HTTPS for transport security instead, and is now the version almost universally meant when people say OAuth. OAuth defines several grant types for different scenarios: authorization code (the standard flow for apps with a server backend), implicit (largely deprecated for security reasons), device code (for TVs and CLIs without a browser), and client credentials (for machine-to-machine access with no user involved).