What Is OAuth?

In a nutshell

OAuth is a way to hand over a "pass" with a defined scope and expiry date, instead of your password. The version in wide use today is OAuth 2.0.

How it works

For a social media connection, the flow goes like this.

1. You press "Connect an account" in the tool and are taken to the social network's screen
2. On that screen, you check the scope of actions the tool is asking for (posting, reading and so on) and press "Allow"
3. The network passes the tool a token, which acts as the pass
4. The tool shows that token and does only the actions you allowed

You log in and give permission on the network's own screen, so the tool never sees your password.

Things to watch for

Read the scope listed on the permission screen before you press the button. If a posting tool asks for more than it needs, it is worth checking before you connect. For tools you no longer use, it is safer to revoke access from the list of connected apps in the network's settings. Treat the moment a staff member leaves, or an outsourcing contract ends, as a chance to review them.

The token you hand over through OAuth is as important a key as a password. Tokens have an expiry date: some are extended automatically when it arrives, and others require you to give permission again. If the tool tells you to reconnect, press "Allow" again on the network's screen. Use it together with two-factor authentication, which protects the login itself. The overall approach to protecting an account is explained in How to protect an official account from takeover.

In SNS TOWN

SNS TOWN connects accounts through each network's permission screen (OAuth 2.0) and never holds your social media passwords. The tokens it receives are stored encrypted. How to connect is in Connect a social media account, and the overall approach to protection is in Security.