OAuth
OAuth is an authorization framework that lets an application receive limited access to another service without obtaining the user’s password. The resulting access is represented by a token with defined permissions and can usually be revoked separately from the user’s account credentials.
How OAuth works
An application requests access to specific scopes, such as reading a calendar or creating a customer record. The user is sent to the service that owns the data, signs in there, and approves or rejects the request. After approval, the application receives an authorization result that it exchanges for an access token.
The application presents that token to the service’s API when performing an allowed operation. Some deployments also issue a refresh token so the application can obtain a new access token without asking the user to approve access again. Expiration and revocation limit how long a stolen or no-longer-needed credential remains useful.
OAuth defines delegated authorization; it does not by itself prove a person’s identity to the client application. Identity layers can be added for sign-in use cases, but an integration should not treat an access token as a general identity claim unless the relevant protocol explicitly supports that use.
Security depends on careful configuration. Redirect destinations must be restricted, authorization responses must be tied to the initiating browser session, tokens must be protected as secrets, and requested scopes should be no broader than the task requires. Public clients can use a proof mechanism so an intercepted authorization result cannot be exchanged by another application.
Why it matters for AI phone calls
An AI phone agent may need delegated access to a scheduling, customer, or support system during a conversation. OAuth allows the organization to authorize that connection without placing a user’s password in the agent configuration. Limited scopes can constrain the integration to the actions it actually needs.
The permission boundary should remain visible in the call design. An agent should confirm sensitive actions, handle expired or revoked access without claiming success, and avoid reading unrelated records simply because the token permits it. Audit logs should identify which integration performed an action while keeping token values out of logs and transcripts.
OAuth protects access to an API; it does not validate webhook messages sent in the opposite direction. Those callbacks may use a separate signature scheme, such as HMAC, according to the sending service’s documentation.