[{"data":1,"prerenderedAt":236},["ShallowReactive",2],{"blog-glossary/oauth":3},{"id":4,"title":5,"body":6,"category":211,"date":212,"dateModified":213,"description":214,"draft":215,"extension":216,"faq":217,"featured":215,"headerVariant":221,"image":222,"keywords":222,"meta":223,"navigation":224,"ogDescription":225,"ogTitle":222,"path":226,"readTime":227,"schemaOrg":228,"schemaType":229,"seo":230,"sitemap":231,"stem":232,"tags":233,"twitterCard":234,"__hash__":235},"blog/blog/glossary/oauth.md","What is OAuth? Social Login Explained",{"type":7,"value":8,"toc":201},"minimark",[9,16,21,24,46,49,53,81,85,88,92,115,119,122,148,170,189],[10,11,12],"tldr",{},[13,14,15],"p",{},"OAuth is the technology behind \"Log in with Google\" buttons. It lets users grant your app access to their data on another service without sharing their password. You never see their Google password. Google confirms who they are and gives you a token. OAuth 2.0 is the current standard. OpenID Connect (OIDC) adds identity information on top of OAuth for authentication.",[17,18,20],"h2",{"id":19},"the-simple-explanation","The Simple Explanation",[13,22,23],{},"When you click \"Log in with Google\":",[25,26,27,31,34,37,40,43],"ol",{},[28,29,30],"li",{},"Your app redirects to Google",[28,32,33],{},"You log in to Google (if not already)",[28,35,36],{},"Google asks \"Allow this app to access your profile?\"",[28,38,39],{},"You click Allow",[28,41,42],{},"Google redirects back with a code",[28,44,45],{},"Your app exchanges the code for user info",[13,47,48],{},"At no point does your app see the user's Google password.",[17,50,52],{"id":51},"why-use-oauth","Why Use OAuth?",[54,55,56,63,69,75],"ul",{},[28,57,58,62],{},[59,60,61],"strong",{},"Better security:"," You don't handle or store passwords",[28,64,65,68],{},[59,66,67],{},"Better UX:"," Users don't create another password to forget",[28,70,71,74],{},[59,72,73],{},"Trust:"," Users trust Google/GitHub more than a new app",[28,76,77,80],{},[59,78,79],{},"Less work:"," Google handles 2FA, password resets, security",[17,82,84],{"id":83},"oauth-vs-openid-connect","OAuth vs OpenID Connect",[13,86,87],{},"OAuth alone is for authorization (access to resources). It doesn't actually tell you who the user is. OpenID Connect adds identity verification on top of OAuth. When you use \"Login with Google\", you're using OIDC.",[17,89,91],{"id":90},"common-oauth-providers","Common OAuth Providers",[54,93,94,97,100,103,106,109,112],{},[28,95,96],{},"Google",[28,98,99],{},"GitHub",[28,101,102],{},"Apple",[28,104,105],{},"Microsoft",[28,107,108],{},"Facebook",[28,110,111],{},"Discord",[28,113,114],{},"Twitter/X",[17,116,118],{"id":117},"implementing-oauth","Implementing OAuth",[13,120,121],{},"Use a library or service rather than building OAuth flows yourself:",[54,123,124,130,136,142],{},[28,125,126,129],{},[59,127,128],{},"NextAuth.js:"," For Next.js apps",[28,131,132,135],{},[59,133,134],{},"Clerk:"," Full auth solution",[28,137,138,141],{},[59,139,140],{},"Supabase Auth:"," Built into Supabase",[28,143,144,147],{},[59,145,146],{},"Auth0:"," Enterprise-focused",[149,150,151,158,164],"faq-section",{},[152,153,155],"faq-item",{"question":154},"What is the difference between OAuth and OpenID Connect?",[13,156,157],{},"OAuth is for authorization (granting access to resources). OpenID Connect (OIDC) is built on OAuth and adds authentication (verifying identity). When you log in with Google, you are using OpenID Connect. OAuth alone does not tell you who the user is, just what they can access.",[152,159,161],{"question":160},"Is OAuth more secure than username and password?",[13,162,163],{},"OAuth can be more secure because users do not share their password with your app. The identity provider (Google, GitHub) handles authentication. They have better security infrastructure. However, you must implement OAuth correctly and validate tokens properly for it to be secure.",[152,165,167],{"question":166},"What happens if the OAuth provider goes down?",[13,168,169],{},"If Google or GitHub is down, users cannot log in using those providers. This is why many apps offer multiple login options or allow linking accounts after initial signup. Consider offering email/password as a backup or multiple OAuth providers.",[171,172,173,179,184],"related-articles",{},[174,175],"related-card",{"description":176,"href":177,"title":178},"What OAuth helps with","/blog/glossary/authentication","Authentication",[174,180],{"description":181,"href":182,"title":183},"Often used with OAuth","/blog/glossary/jwt","JWT",[174,185],{"description":186,"href":187,"title":188},"Extra security layer","/blog/glossary/two-factor","Two-Factor Authentication",[190,191,194,198],"cta-box",{"href":192,"label":193},"/","Start Free Scan",[17,195,197],{"id":196},"check-your-oauth-setup","Check Your OAuth Setup",[13,199,200],{},"Scan your app for authentication issues.",{"title":202,"searchDepth":203,"depth":203,"links":204},"",2,[205,206,207,208,209,210],{"id":19,"depth":203,"text":20},{"id":51,"depth":203,"text":52},{"id":83,"depth":203,"text":84},{"id":90,"depth":203,"text":91},{"id":117,"depth":203,"text":118},{"id":196,"depth":203,"text":197},"glossary","2026-01-09","2026-02-16","Learn what OAuth is, how social login works, and why it's more secure than building your own authentication. Plain English guide.",false,"md",[218,219,220],{"question":154,"answer":157},{"question":160,"answer":163},{"question":166,"answer":169},"green",null,{},true,"OAuth lets users log in with Google, GitHub, and more. Learn how it works.","/blog/glossary/oauth","4 min read","[object Object]","DefinedTerm",{"title":5,"description":214},{"loc":226},"blog/glossary/oauth",[],"summary_large_image","cKlcqJXS6rYSkb3uY_YK7wiUS3xJG3iN2UjT3HFnjn8",1775843922614]