OAuth
OAuth lets a user authorize scoped access to a service without handing an application the account password.
Also called: delegated authorization
Definition
OAuth is an authorization framework used by many platforms to grant an application limited access through tokens rather than direct password sharing.
Why it matters to the business
Delegated authorization can reduce credential handling and make access easier to revoke or scope to the implementation.
How it works
The user authorizes the requested permissions with the vendor. The vendor issues tokens that the application uses within the approved scope and lifetime.
Where it appears in real systems
CRM, Google or Microsoft services, accounting platforms, messaging systems and other SaaS products commonly use OAuth.
Common failure modes
- The requested scope is broader than necessary.
- Refresh tokens expire or are revoked.
- A user disconnects the application.
- The implementation assumes permissions it was never granted.
Implementation considerations
- Request only the permissions needed.
- Handle token refresh and revocation.
- Keep authorization state out of ordinary intake forms.
- Document who owns the connection.
When it is appropriate
Prefer vendor-native delegated authorization when the platform supports the required implementation scope.
When it is not appropriate
Do not copy passwords into forms merely because delegated authorization takes more setup.
Relationship to BYFORCE
BYFORCE access policy prefers OAuth or vendor-native connections where supported.
Source basis
- docs/website/BYFORCE_SELF_SERVICE_INTAKE_SPEC_2026-09-23.json