OAuth
OAuth (Open Authorization) is an open-standard authorization protocol that allows users to grant third-party applications access to their resources on a service without exposing account credentials. The protocol implements permission delegation by issuing access tokens, supporting access control with defined scopes and expiration periods. OAuth is widely used for third-party login and API access authorization across internet services; the current mainstream version is OAuth 2.0.
Core Facts
Timeline (last 90 days)
After an Agent is deleted, the OAuth grants it used often still remain alive, because the provisioning process bypasses the identity provider, creating orphan credentials.
A single compromised MCP server can execute prompt injection, credential exfiltration, delivery of phishing toolkit fingerprints, PII leakage, token theft via OAuth, and SSRF attacks.
The developer terms of mainstream social platforms generally require OAuth rather than direct key connections.
PostNitro for Agents uses OAuth authorization rather than API keys for integration.
If the connection wizard asks for "your own app information", it means this deployment does not have a built-in shared OAuth client, and the user needs to register an app in the provider's developer console, obtain a client ID and secret, and fill the callback address back into OGAD.
When connecting a Google or Microsoft account, the OAuth permission flow must be completed: the user logs in in the browser and checks the permitted access scopes (such as reading mail but not sending mail), and the provider returns a revocable token to OGAD. Reading and sending are two separate sets of permissions.
Using platform APIs requires handling maintenance work such as OAuth refresh tokens, quota limits, and breaking changes caused by interface version upgrades.
Cross-platform authorization and operation are core technical and compliance issues facing personal AI assistants, involving security mechanisms such as OAuth authorization, session management and sensitive information protection.
Scenarios such as HMAC signatures, OAuth tokens, and S3 presigned URLs all write the expiration time into the credential itself, rather than relying on a tacit agreement between both parties about the duration.
Atlassian administrators must first add n8n's OAuth callback domain to the whitelist in the organization settings, otherwise the Accept button on the authorization page is grayed out.
40 more timeline events
All Facts (20)
WorkBuddy has a built-in connector mechanism that interfaces with the data layer of target software via API authorization (OAuth protocol)—for example, reading messages and sending replies through the WeCom open platform API—rather than simulating screen clicks.
65%UnverifiedCodex安装应用时使用OAuth授权流程，要求用户关联对应平台的线上账号
95%UnverifiedOAuth是一种授权框架，通过颁发短期有效的Access Token和用于续期的Refresh Token来允许第三方应用在不暴露用户密码的前提下获得有限访问权限
95%UnverifiedLark CLI的认证层支持OAuth登录、身份切换和Scope管理
90%Unverified传统上开发者需要在Google Cloud Console中创建项目、配置OAuth同意屏幕、设置重定向URI等步骤才能访问用户Gmail和Drive数据
90%Unverified飞书CLI底层调用的是飞书开放平台的统一API，不同终端通过相同的应用凭证和OAuth授权机制访问同一套数据
90%UnverifiedOAuth 2.0的Access Token通常有效期较短（15分钟到1小时），Refresh Token有效期较长
90%UnverifiedHMAC的变体被广泛应用于OAuth授权、AWS API签名、微信支付签名等主流场景
90%UnverifiedOAuth伪造是指第三方工具通过模拟官方客户端的client_id来欺骗授权服务器，绕过API计费体系
90%UnverifiedIn the OAuth flow, the MCP server returns a 401 Unauthorized response to requests without a valid token, along with a login URL pointing to the authorization server.
60%UnverifiedThe OAuth pattern authenticates users by introducing an identity provider, and after the tool authenticates, it issues an access token for the agent to use.
60%Unverified2022年，GitHub曾披露攻击者利用被盗的OAuth令牌访问了多个组织的私有仓库，影响了包括npm在内的多个重要项目
55%UnverifiedAfter an Agent is deleted, the OAuth grants it used often still remain alive, because the provisioning process bypasses the identity provider, creating orphan credentials.
50%UnverifiedA single compromised MCP server can execute prompt injection, credential exfiltration, delivery of phishing toolkit fingerprints, PII leakage, token theft via OAuth, and SSRF attacks.
50%UnverifiedThe developer terms of mainstream social platforms generally require OAuth rather than direct key connections.
50%UnverifiedPostNitro for Agents uses OAuth authorization rather than API keys for integration.
50%UnverifiedWhen connecting a Google or Microsoft account, the OAuth permission flow must be completed: the user logs in in the browser and checks the permitted access scopes (such as reading mail but not sending mail), and the provider returns a revocable token to OGAD. Reading and sending are two separate sets of permissions.
50%UnverifiedIf the connection wizard asks for "your own app information", it means this deployment does not have a built-in shared OAuth client, and the user needs to register an app in the provider's developer console, obtain a client ID and secret, and fill the callback address back into OGAD.
50%UnverifiedUsing platform APIs requires handling maintenance work such as OAuth refresh tokens, quota limits, and breaking changes caused by interface version upgrades.
50%UnverifiedCross-platform authorization and operation are core technical and compliance issues facing personal AI assistants, involving security mechanisms such as OAuth authorization, session management and sensitive information protection.
50%