OAuth is an open authorization standard that lets one application act on your account at another service, with limited permissions, without ever receiving your password.
How OAuth works
OAuth 2.0, published as RFC 6749 in 2012, is the version in use today. The common "authorization code" flow goes like this:
- The app sends you to the service's sign-in page, asking for specific scopes, such as "post on your behalf."
- You sign in there and approve.
- The service sends the app a short-lived code.
- The app exchanges the code for an access token, and often a refresh token.
- The app calls the API with the access token until it expires, then uses the refresh token to get a new one.
PKCE, an extension, protects the code exchange for public clients such as mobile and desktop apps.
An example
You connect a LinkedIn account to a scheduler. LinkedIn shows which permissions the scheduler wants. You approve, and the scheduler can now post for you, but it never saw your LinkedIn password and you can revoke access from LinkedIn at any time.
Why it matters for AI-agent publishing
OAuth tokens are the keys to your social accounts. Whoever holds them can post. They should never be handed to an agent directly.
SocialHandoff holds network tokens itself, encrypted at rest with AES-256-GCM, and gives agents a separate API key with narrower permissions. Revoking an agent's key leaves your account connections intact. See connect X and connect LinkedIn for the account flows.