OAuth

What it means

OAuth is an open standard for delegating access. It lets one application reach a user's data in another application without knowing their password. The user signs in directly with the provider, approves the scope of access, and the application receives a temporary token that can only be used for the permitted operations.

The key concept is the scope of access. Accounting software may be allowed to read account movements but not to enter payments. Tokens have limited validity and are refreshed, so even if one leaks the damage is smaller than with a leaked password, which opens everything and stays valid for a long time.

Today OAuth 2.0 is used, often together with OpenID Connect, which adds identity verification. Buttons such as Sign in with Google or Microsoft are built on exactly these standards. For a business it means fewer passwords and one central place where access is switched on and off.

How it works in practice

In banking OAuth underpins open banking under the PSD2 directive. When you connect your accounting system to the bank, the bank redirects you to its own sign-in, verifies you with strong authentication, and the accounting software receives a token for downloading statements. The bank never passes your sign-in details to the third party.

In cloud applications OAuth connects CRM, invoicing, the online shop, calendars or file storage. Instead of sharing passwords between systems, each connection is authorised separately and can be revoked separately. Compared with a static API key, another advantage is that access is tied to a specific user and their permissions.

As part of access management we recommend keeping a list of connected applications and reviewing it regularly. Most services show it in the account settings as connected or authorised apps. Connections no longer needed, especially after work with a supplier ends, should be revoked.

What to watch out for

OAuth protects the password, not the data itself. An application with granted access can read and store it, so when choosing a tool you need to judge its trustworthiness and whether it acts as a processor under GDPR. Attackers also use fake consent requests that look like legitimate applications.

Bank connections are valid for a limited time and must then be renewed. If statements stop flowing into the accounts, the most common cause is exactly that the consent has expired. It pays to watch the notifications and plan the renewal so that no gap appears in the books.