OAuth Connection

An OAuth connection is the authentication method most no-code platforms use to link your account in a third-party app (Google, Slack, Salesforce) to the automation or builder tool, using the OAuth 2.0 protocol to grant scoped, revocable access without the platform ever seeing or storing your actual password. Clicking "Connect Google Sheets" inside Zapier and being redirected to a Google login/consent screen ("Zapier wants to: view and manage your spreadsheets") is an OAuth flow — this is functionally different, and more secure, than the alternative of pasting a raw API key into a connection field, which is why most modern, security-conscious integrations default to OAuth wherever the provider supports it. Why it matters: OAuth connections are the mechanism that lets no-code platforms offer one-click "Connect your account" buttons instead of forcing every builder to hunt down and generate an API key from each individual app's developer settings — a meaningfully lower barrier to entry that partly explains why platforms like Zapier can onboard non-technical users at scale. It also matters for security posture: because OAuth grants scoped, revocable permissions (you can see and individually revoke "Zapier's access to my Google account" from Google's own security settings, without needing to change your Google password), it limits blast radius if a no-code platform is ever compromised — an attacker who breaches Zapier's systems gets access only to what each user explicitly authorized, not raw account passwords. How it works: the OAuth 2.0 "authorization code" flow (the standard variant used by most consumer apps) works roughly as: (1) the no-code platform redirects you to the third-party app's login/consent page; (2) you log in (if not already) and approve the specific permissions requested (read contacts, send emails, etc.); (3) the third-party app redirects back to the no-code platform with a temporary authorization code; (4) the platform exchanges that code, server-to-server, for an access token (and often a longer-lived refresh token) which it then stores and uses to make API calls on your behalf, automatically refreshing the access token when it expires without requiring you to re-authenticate. Worked example — connecting Gmail to Make: clicking "Add" on a Gmail module in Make redirects to Google's OAuth consent screen listing exactly which scopes are requested (e.g., `gmail.send`, `gmail.readonly`); after you approve, Make stores an encrypted access/refresh token pair tied to your account, and every subsequent "Send Email" or "Watch New Email" module in your scenarios uses that stored token rather than asking you to log in again — until you manually revoke access from Google's "Third-party apps with account access" settings page, which immediately breaks any Make scenario relying on that connection.