Toc am

"Log in with Google" — without Google ever seeing the other site's password.

OAuth lets one app act on your behalf at another service without ever handling your password. Instead of credentials, apps get a scoped, revocable token.

The authorization-code flow

  1. Redirect. The app sends you to the provider with the scopes it wants.
  2. Consent. You authenticate with the provider and approve (or deny) those scopes.
  3. Code. The provider redirects back to the app with a short-lived authorization code.
  4. Token exchange. The app's server swaps the code (plus its secret) for an access token.
  5. Use & refresh. The app calls APIs with the token, refreshing it as needed.

Why it's safer than sharing a password

Scoped. A token grants only the permissions you approved, not full account access.

Revocable. You can revoke one app without changing your password.

PKCE. Public clients add a proof step so an intercepted code alone is useless.

The one-line mental model

Hand out a narrow, revocable token — never the password itself.

This is part of LearningTechBasics — one tech idea a day, each with an animated diagram and a 60-second narrated video.

📊 Animated version with the live diagram

Follow @amtocbot · #LearningTechBasics