How does OAuth let you sign in with Google ?
Click "Sign in with Google" on some app you've never used before, and a few seconds later you're logged in — no new password, no email verification link, nothing. The app somehow knows who you are, and it never once asked Google for your password. That handoff is called OAuth, and it's one of the more elegant pieces of plumbing on the modern web.
The problem OAuth solves
Before OAuth was common, "connecting" one service to another usually meant typing your actual password for Service A into Service B's login form. Service B would then log in as you, silently, whenever it needed to. That's a terrible deal: Service B now holds a password that unlocks everything in your Google account, forever, with no way for you to revoke just that one connection without changing your password everywhere. OAuth exists to replace "hand over your password" with "hand over a narrow, revocable permission slip."
The three parties in the room
Every OAuth flow has three players. The client is the app you're trying to log into (say, a scheduling tool). The resource owner is you. The authorization server is Google, which actually knows your credentials and decides what to share. The client never talks to your password at all — it only ever talks to Google, and only after you've said yes.
Step one: the redirect
When you click "Sign in with Google," the app doesn't show you a login box of its own. It redirects your browser to a Google URL, tacking on a few details: which app is asking (a registered client ID), what it wants access to (just your name and email, say), and a "come back here when you're done" address. Crucially, this redirect happens in your browser, not on the app's server — so you land on a real accounts.google.com page, not a lookalike the app controls.
Step two: you decide
On that Google page, you're already logged in (or you log in now), and Google shows you exactly what the app is asking for: "This app wants to see your name and email address." You approve or you don't. This is the whole point of the design — the permission is scoped and visible, and it's Google's own page asking, not the app's.
Step three: the code
If you approve, Google redirects your browser back to the app's "come back here" address with a short-lived, one-time authorization code tacked onto the URL. This code is deliberately useless on its own — it's not your identity, it's a claim ticket. Anyone who intercepted it in transit would find it already expired or already redeemed by the time they could use it.
Step four: the exchange
Here's the step that happens where you can't see it. The app's server (not your browser) takes that code and calls Google directly, over a private server-to-server connection, along with a secret only the real app knows. Google checks the code and the secret, and if both are valid, hands back an access token — and often basic profile info like your name and email. That token is what the app actually uses to fetch your details from Google's API on this and future requests, and it can be revoked or expired without touching your Google password at all.
Why the redirect dance matters
It would be simpler for the app to just ask you for your Google password directly. The whole point of routing you through Google's own page is that your password never leaves Google's servers — the app receives a token that proves Google vouches for you, scoped to exactly what you approved, and nothing more. If the app gets breached, the attacker gets a revocable token for a narrow slice of your account, not the master key.
The takeaway
"Sign in with Google" isn't magic — it's a deliberate hand-off where your browser carries you to Google to approve a specific, limited request, Google hands back a one-time code, and the app trades that code for a token behind the scenes. You get logged in without ever typing your password into a site that isn't Google's, and you can revoke the connection later without changing a single password.
This explainer was made with LineLapse — type a topic, get a hand-drawn video. Make your own →