OAuth 2.0
OAuth 2.0 is an authorization framework that lets a client application obtain limited access to a service, on a user's behalf or on its own behalf.
How an application gets access
The client is the application asking for access. The resource server holds the protected resource. An authorization server issues an access token, which the client sends when requesting an operation from the resource server.
OAuth supports several grants, or ways to obtain tokens. Not every flow involves someone clicking a consent screen; authorization can be arranged in advance. OAuth itself does not define how an application verifies a user’s identity for sign-in. OpenID Connect adds that part.
Permission has a scope
A scheduling application authorized to read calendar availability does not automatically get access to email or account administration. It sends its token to the calendar service, which evaluates the requested operation.
A legitimate authorization server can still grant access to an unwanted application if the approval process allows it. That is why a consent-phishing investigation needs to check the application and its permissions, not just whether the sign-in page was real.
RFC 9700 updates OAuth’s security guidance and prohibits the resource owner password credentials grant. Check integrations against that guidance as well as the permissions they request.