OAuth

OAuth is an authorization protocol that lets users grant third-party apps limited access to their accounts without sharing their password. When you click "Sign in with Google," OAuth handles the secure handoff. It is widely used for social logins and API access, separating authentication (who you are) from authorization (what you can do).

The hotel analogy fits perfectly: OAuth is a key card, not the master key. When you connect your accounting software to your bank feed, you do not hand over your banking password — the bank shows you a consent screen ("this app wants to read transactions"), you approve, and the app receives a limited key that opens only that one door. You can revoke the key any time without changing your password.

Why it matters for your project: OAuth shows up in two places. First, login — offering "Sign in with Google" removes a signup form, eliminates forgotten-password support for those users, and means you never store their password at all, which shrinks your security exposure. Second, integrations — when your product needs to touch a customer's calendar, email, or files, OAuth is the trustworthy way to ask. Users see exactly what they are granting, which reads as professionalism, not risk.

In technical terms, OAuth governs access to an API on someone's behalf, and the credential that comes out of the handshake is often a JWT — the signed token your app then carries on each request. If your brief includes "connect to the user's [Google/Microsoft/Xero] account," OAuth is the machinery behind that sentence, and it is a solved problem, not an experiment.