OAuth
Behind every 'Sign in with Google' button: a standard that lets people allow one app to act on their account elsewhere without handing over a password.
Updated October 2026 · with examples from our own builds
What does OAuth mean in practice?
OAuth is what sits behind social sign-in and 'Connect your Gmail'. The user approves access on the provider's own page, and your app receives a token limited to what was approved, which can be revoked without changing any password.
Its lead times are easy to miss. Providers make you register an app, and sensitive access, such as reading a user's email, can require verification and an independent security assessment before real users can connect. That can take longer than building the feature.
Sign-in through OAuth also needs a policy: may it create new accounts, or only identify existing ones?
OAuth at a glance
- Used for
- Social sign-in and connecting third-party accounts
- Lead time
- App registration and, for sensitive scopes, provider review
- Decide
- Whether OAuth sign-in may create new accounts
Where has OAuth come up in our builds?
Gmail and Microsoft 365 senders are written, but connecting those mailboxes needs Google and Microsoft OAuth apps, and reading replies automatically needs Google's CASA security assessment, so mailboxes connect over SMTP today and replies are marked by hand.
Partners create staff accounts and each person sets their own password from an emailed link; Google sign-in can identify an existing account but never creates one.
Live operation of some Google services is waiting on a Google API key and a Google OAuth app.
Common questions about OAuth
How long does Google OAuth approval take?
Basic sign-in is quick to set up. Access to sensitive data such as a user's Gmail needs Google's verification and, for restricted scopes, an independent security assessment, so plan it as its own workstream with lead time.
Should 'Sign in with Google' create accounts automatically?
Only if anyone with a Google account should be able to join. For staff tools, let it identify existing accounts only, as BogarInfra's admin panel does, so access is still granted by a person.
Related terms
Sources
Planning a product and not sure where OAuth fits? Ask us, or browse all 116 terms in the glossary.