OAuth

OAuth, short for Open Authorization, is the open framework for delegated access that lets a user authorize an application to act against an API on their behalf without ever sharing a password. Rather than handing over credentials, the application obtains a scoped, revocable token from an authorization server and presents it to the resource. It is the authorization backbone of the modern API economy, most commonly deployed today in its OAuth 2.0 form.

• Delegated access - A user grants an app limited access to their resources instead of sharing a login.
• Token-based - Access is carried by tokens that are short-lived, scoped, and revocable rather than by static secrets.
• Scopes - Permission strings bound exactly what a token can read or write.
• Separation of concerns - Distinct roles for the user, the app, the authorization server, and the resource server keep credentials isolated.
• Broad adoption - Supported by essentially every major platform, from Google and GitHub to open-banking regimes.

Across the sectors I score, the presence of OAuth is one of the clearest signals that a provider has a real authorization posture rather than a query-string API key bolted on. In regulated spaces like open banking, authorization_code plus client_credentials sits at the center of consent, accreditation, and audit. The agentic turn is now pushing the harder question — not just whether OAuth is present, but whether the whole grant, client-registration, and token lifecycle is scriptable enough for an autonomous agent to onboard and act without a human clicking through a console, which is exactly what my recent provider write-ups keep measuring.