Glossary · Security & access
OAuth 2.0
Also called: OAuth, OAuth2, Sign in with … and allow access
OAuth 2.0 is an authorization standard that lets you grant one application limited, revocable access to your account in another service, without giving it your password, by issuing it access tokens with specific scopes.
When you click "Connect HubSpot" and land on HubSpot's own screen asking whether to allow access, that's OAuth. The flow, simplified:
- The app sends you to the provider with a list of scopes (what it wants to do).
- You sign in at the provider and approve.
- The provider sends the app a short-lived access token and usually a longer-lived refresh token.
- The app calls the API with the access token, and uses the refresh token to get new ones when it expires.
Why it's better than sharing a password or a master key
- Least privilege. Scopes limit access ("read and write contacts", not "everything").
- Revocable. You can disconnect the app at the provider without changing your password.
- No password exposure. The app never sees your credentials.
What to check before you approve
Read the scope list. A tool that only posts to Slack shouldn't ask to read every private message. Good vendors publish which scope unlocks which feature, so you can judge the request. And know who owns the connection: if the employee who connected it leaves and their account is disabled, the token often dies with it.
In Fluxo Flow
OAuth connectors (Slack, HubSpot, Notion, Salesforce, Google, Microsoft 365 and others) send you to the app's own screen to approve access. Tokens are encrypted at rest with a key kept outside the database and renewed automatically. Each integration page lists the permissions it asks for and what each one is used for, and you can disconnect any time in Settings → Integrations.
Read next
Related terms
- API key vs OAuthAn API key is a static secret that identifies the caller and grants whatever access it was created with, while OAuth issues short-lived, scoped tokens after a user approves access; OAuth is safer for user-facing connections, keys are simpler for server-to-server use.
- Scoped API keyA scoped API key is an API credential limited to specific permissions (scopes), often with an expiry date, so that a leaked or misused key can only do what it was explicitly allowed to do.
- RBAC (role-based access control)Role-based access control (RBAC) is a way of managing permissions in which access rights are attached to roles (such as Admin, Editor or Viewer) and people get rights by being assigned a role, rather than permission by permission.
- OpenAI-compatible endpointAn OpenAI-compatible endpoint is an AI API that accepts requests and returns responses in the same format as OpenAI's API, so software written for OpenAI can call other providers, gateways or self-hosted models by changing the base URL and key.
- No-code automationNo-code automation is building automated workflows with visual tools (drag-and-drop canvases, forms and pickers) instead of writing code, so people who know the process can automate it themselves.