OAuth let apps use a user's other accounts by swapping a token for the password.

In 2006 the web was full of services that wanted to read a user's other accounts, but there was no agreed way to let them. The blunt options were to ask for the password or to build a separate and incompatible integration for every pair of sites.

Blaine Cook, Chris Messina, Larry Halff and David Recordon met over using OpenID with the Twitter and Ma.gnolia APIs and concluded that no open standard for API access delegation existed. They drafted OAuth in public, and it became OAuth Core 1.0 in October 2007, then OAuth 1.0 in April 2010 and OAuth 2.0 in October 2012.

The fix was to stop sharing the secret. The user approves access, and an authorization server hands the third-party app an access token scoped to what was granted. The token is a revocable 'valet key', so the app can act for the user without the user's password ever leaving the account provider.

Once the pattern existed, the big platforms built on it. From August 2010 all third-party Twitter applications had to use OAuth, and Google, Meta, Microsoft and Amazon use it as the way to let outside apps reach a user's account.