Security and access
OAuth
A standard sign-in method that lets you grant an app limited access to an account without sharing your password. Remote MCP servers commonly use it.
OAuth is the standard sign-in method that lets you grant an application limited access to an account without handing over your password. You are sent to the vendor's own login page, shown what the application is asking for, and returned with a token that the application uses from then on. Most remote MCP servers connect this way.
For MCP users the important parts are the consent screen and the token. The consent screen lists the scopes requested, which is your chance to see whether a 'reporting' connection is asking for write access. The token can expire and can be revoked from the vendor's account settings, which makes OAuth connections easier to govern than pasted API keys.
OAuth does not make a connection safe by itself. A server can request broad scopes and a user can approve them without reading. Treat the consent screen as the place where least privilege is decided, and keep a note of which assistants have been authorised against which accounts.