OAuth

OAuth is a visitor lanyard — not a new password, and not your employee badge.

The front desk prints a sticker: who you are, which rooms, until when. The elevators read the sticker. The server closet ignores it. You can shred the sticker at 5pm. The badge in your pocket never left your pocket.

You've clicked Sign in with Google; that's this handshake.

What the sticker actually says

A token is the sticker. It proves identity, lists permission scope, and often expires. The app never sees your password. The identity provider (Google, GitHub, Slack) asks you, then hands the app a pass cut to the rooms you approved.

That is a different deal than an API key. A key is usually all-or-nothing: whoever holds it can do everything the account can do. Fine-ish when only you hold it. Not fine when you hand it to an agent that runs while you sleep and can be confidently wrong.

So you give the agent its own lanyard. Read the calendar, don't delete it. Post in one channel, don't touch billing. Draft the mail, don't send. Revoke one pass and the rest of the house stays locked. Your password did not change.

Auth in the builder (Better Auth, Clerk) is how your app becomes the front desk. OAuth is how your app — or your agent — visits someone else's building without collecting their house keys. Put the client secret in env, not in the repo.

If a tool asks for more rooms than the demo needs, refuse. You can widen later. You cannot un-print a wide sticker.

What this unlocks

Once the lanyard exists, "the agent needs GitHub" stops meaning "paste my password." It means a labeled, expiring, revocable pass.

A master key is a liability. A sticker is a contract.