Permission without a password
OAuth is a standard for giving an application limited access to a service without telling it your password. After signing in with a Google account, you may see a screen asking whether to allow an app to view your calendar. OAuth is the mechanism behind that exchange.
A limited key, not the master key
Think of it as handing over a key that opens certain rooms for a limited time, rather than the key to the house. When you approve, the application receives an access token, and uses that token to reach the service.
Permission to read a calendar and permission to add or delete events are separate. The extent of what is granted is called a scope, and approving only the minimum scope needed is the basic safety rule.
Where you meet it
- Connecting an outside app to Google Drive or Gmail
- Using a social account to sign in to another service
- Authorizing a tool such as gogcli to operate Google services
- Granting an AI agent access to your calendar or files
OAuth is primarily about what is authorized rather than verifying who you are. For sign-in specifically, OpenID Connect is often layered on top of it.
Reading the consent screen
Do not approve everything out of convenience. Check who publishes the app, which permissions it is asking for, and why. An app that only shows your schedule but requests permission to delete mail is a warning sign.
Connections you no longer use can be revoked from your account settings at Google or the service in question. OAuth is safer than handing over a password, but the keys you have issued still need managing.