What is OAuth?
OAuth is the standard behind 'Sign in with Google' and similar buttons. It lets a user give your app limited access to their account on another service without ever sharing their password with you. Done well, it is safer than building your own login. Done badly, it can hand an attacker control of someone's account.
ON THIS PAGE
What it means
When a user clicks 'Sign in with Google', your app sends them to Google, Google asks if they approve, and then sends them back to your app with a one-time code. Your server swaps that code for proof of who they are.
The swap uses a secret that identifies your app. That secret has to stay on your server, and the address Google sends people back to has to be tightly controlled.
Why it matters for vibe-coded apps
OAuth has many moving parts, and setup guides copied into AI prompts often skip the parts that keep it safe.
- A leaked client secret lets someone pretend to be your app.
- A loose redirect address can send login codes to an attacker's site.
- Asking for more permissions than you need makes any breach worse.
Example
Setting up Google sign-in.
// Front end
const clientSecret = "GOCSPX-9f2k…";// Server only
const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
// In the Google console, allow only your exact addresses:
// https://yourapp.com/auth/callbackThe client ID is public and fine in the browser. Only the secret must be hidden.
How to check if your app has this problem
- 1Search your front-end code for client_secret, clientSecret and anything starting GOCSPX-.
- 2Open your provider's console and look at the allowed redirect addresses. Remove wildcards and old test addresses.
- 3Check which permissions (scopes) you ask for. Remove any you do not use.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Use a managed provider such as Supabase Auth, Firebase Auth or Auth.js instead of writing your own.
- 2Keep the client secret in server-side environment variables.
- 3List exact redirect addresses with no wildcards.
- 4Ask only for the permissions you need, and rotate the secret if it ever leaked.
Review how my project handles OAuth sign-in. Make sure the client secret is only read from a server-side environment variable, the redirect address is an exact URL from a fixed list, a state value (and PKCE where supported) is used, and only the minimum scopes are requested. List anything you change. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for OAuth issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- JSON Web Token (JWT)A signed pass your app hands a user after they log in.
- API key exposureA secret key for a paid service ends up where the public can see it.
- Authentication vs authorizationChecking who someone is, versus checking what they're allowed to do.
- Two-factor authentication (2FA)A second step at login, like a code from your phone.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.