You are signed in. Close

You are signed out. Close

Thank you. Your subscription has started. Close

Thank you. You will get an email when a new comic comes out. Close

We could not confirm your payment. If you paid, use the link "Sign in" at the bottom of the page. Close

Something went wrong on our side. Please try again in a moment. Close

Project Visually
Random Sign in Subscribe

Sign in with Google: how OAuth lets an app in without your password

One tap on "Sign in with Google", and a small app you met five minutes ago can read your calendar, though it never saw your password and never will. Behind that tap, your browser is sent to Google and back while the two of them pass notes. Follow one sign-in from start to end and meet OAuth as it really runs: the redirect, the consent screen and its scopes, the authorization code, the access token and the ID token of OpenID Connect, refresh tokens, PKCE, and what the app can and cannot do with all of it.