Term · Data, privacy & security
OAuth
With OAuth you give an app or integration access to another system, without sharing your password.
In short
OAuth is an open standard that lets you give an app or integration access to your data in another system, without sharing your password. You log in yourself and give permission. The app then gets a token: a digital key with limited rights, which usually expires after a while.
What is OAuth?
OAuth is a standard for granting access. It lets an app or API integration access your data in another system, without you sharing your password.
The current version is called OAuth 2.0. Large services such as Google and Microsoft use it for their APIs. With the Exact Online API, too, you log in via OAuth.
How does OAuth work?
You recognise it from a screen such as ‘This app wants access to your calendar. Allow?’ Behind it, this happens:
- The app sends you to the login screen of the other system. You log in there yourself.
- You see which rights the app is asking for, and you give permission.
- The system gives the app a token. That is a digital key that usually expires after a while.
- The app uses that token to fetch data. The app never sees your password.
Often the app also gets a refresh token. With it, the app fetches a new token itself, so that you do not have to log in again each time.
Example in an SME
Example
Say you have your webshop connected to your accounting package. During setup you log in to the accounting package once and give the integration permission. After that, the integration fetches the data itself. Is the integration connected to an employee's account, and does that employee leave? Then you revoke the access and connect the integration again to another account.
What should you look out for with OAuth?
- No more rights than needed. Read which rights an app is asking for before you click Allow.
- Check now and then which apps have access. In many systems you see a list, and you can revoke access.
- Agree which account an integration is connected to. Then you know what needs to happen when someone leaves.
Not every system works with OAuth. Some use an API key. For ordinary login by people, two-factor authentication is the extra security. Want to have systems connected? Read how I approach integrations and automation.
Frequently asked questions
Is OAuth the same as ‘sign in with Google or Microsoft’?
Almost. Signing in with Google or Microsoft works with OpenID Connect, which is built on OAuth 2.0. OAuth itself is about granting access to data, not about who you are.
Is OAuth safer than putting your password in an app?
Yes, on three points. Your password does not reach the app. The app only gets the rights you allow. And you can revoke access without changing your password.
Sources: RFC 6749: The OAuth 2.0 Authorization Framework, Google: Using OAuth 2.0 to access Google APIs, Microsoft: OAuth 2.0 and OpenID Connect protocols, OpenID Foundation: How OpenID Connect works and Apideck: Exact Online API integration. Consulted on 7 October 2026.
Written by Bart van Engelenhoven Founder of Uniekaiconsultancy in Ede, the Netherlands. Bart analyses how SMEs work and builds software, integrations and AI applications himself. Last updated: 7 October 2026
Read more
Term
API key
What is an API key? A secret code that gives software access to another system. How it works, and how to handle it safely.
Read moreTerm
API
What is an API? The fixed entrance to a software package through which other software retrieves and sends data. Explanation with an example.
Read moreTerm
Two-factor authentication (2FA)
Two-factor authentication (2FA) asks for an extra step besides your password when you log in. How it works, the forms it takes and where to start.
Read moreNext step
Curious what could work for you?
- The first conversation is free and without obligation
- By phone or at your premises
- You speak directly with me
Bart van Engelenhoven You tell me what takes up your time, I tell you honestly whether I can help.