Glossary
OAuth
Meaning and details
OAuth is the standard behind every Connect with X button. Instead of giving your app their password, the user logs in at the provider, and the provider hands your app a scoped token: permission to do specific things, lik...
OAuth meaning
An open standard for authorization: lets a user grant one service limited access to their account on another, without sharing passwords.
What is OAuth?
OAuth is the standard behind every Connect with X button. Instead of giving your app their password, the user logs in at the provider, and the provider hands your app a scoped token: permission to do specific things, like read the calendar, and nothing else. Access tokens expire; refresh tokens renew them. Version 2.1 with PKCE is what modern implementations use.
Why it matters to an indie builder: OAuth is how integrations get built safely. Reading a user's GitHub repos, posting to their Slack, pulling Stripe data, all arrive as OAuth flows, and the pattern is identical from provider to provider. Understanding what you are holding, a bearer token that acts as the user, is the difference between an integration and a liability.
A concrete example: a tool that summarizes a team's Pull Request activity. The user clicks Connect GitHub, approves the read scope, and your app receives a token limited to reading repos. It cannot push code, delete anything or read other services. If your database leaks, the blast radius is read-only access that the user can revoke from their GitHub settings in two clicks. Password-sharing integrations have no such off switch.
Common mistakes: storing tokens in plaintext or in logs (encrypt at rest; tokens in log files are a classic breach), requesting every scope because it is easier (ask for the minimum; users see the list and decline broad ones), skipping PKCE on public clients, which opens an interception window, and ignoring refresh handling, so the integration silently dies in a week and the user blames your product. Off-the-shelf auth providers, the ones listed under the auth blocks on IndieBoot, run these flows correctly so you do not have to.