What Is OAuth 2.0?

Delegated access to a service

OAuth 2.0 lets an application obtain authorization to access a protected resource under a defined flow and scope. In a mailbox integration, that can allow approved access without giving the application the user's password. The authorization server, application and resource service have distinct roles. The provider's consent and administration policies determine which permissions can actually be granted and by whom.

OAuth is an authorization framework rather than an email sender-authentication record. It does not publish SPF, create a DKIM signature or establish DMARC alignment. It is also distinct from OpenID Connect, which adds an identity layer for authentication use cases. A successful application connection therefore answers a different question from whether a message's author domain authenticates at the receiving mailbox.

Verify the granted scope

Before connecting a workflow, inspect the requested permissions and confirm that they match the approved task. Reading mail, sending mail and accessing contacts are different capabilities. Use current provider instructions and current OAuth security guidance rather than copying an older password-based flow. A token being present in configuration does not prove that its scope, account or remaining validity is correct.

Track lifecycle and recovery

An integration can stop working after permission revocation, account changes or token-related failure. Record the connected account, responsible administrator, granted capabilities and recovery procedure without storing secrets in shared documentation. Test the real operation with a controlled example and read the target system back. An authorization success screen alone does not prove that a message was sent or a CRM record was updated.

RFC 9700 provides updated security guidance alongside the original framework. Follow supported provider libraries and flows, keep tokens protected and separate connection health from campaign performance. OAuth can make access manageable and scoped, but it does not establish permission to contact a prospect or make every downstream action authorized simply because the application has technical access.