OAuth

OAuth is an open standard that lets one app act for a user in another app without the user's password. The current version is OAuth 2.0. The user approves a specific set of permissions, and the app gets an access token limited to those permissions.

How the flow works

1. The app sends the user to the provider's approval page, which lists the permissions, called scopes, the app wants.
2. The user approves or declines.
3. If the user approves, the provider sends them back to the app with a short-lived authorization code.
4. The app exchanges the code for an access token, and often a refresh token, and uses it to call the API.

The token only allows what the user approved, such as read-only access. The user can disconnect at any time, which revokes the token.

OAuth in Stripe

Stripe Connect uses OAuth to link a platform to a merchant's Stripe account. The merchant approves the connection, and the platform gets access tied to that connected account. This is safer than asking the merchant to paste in an API key, because the access is limited and either side can revoke it.

OAuth and ChargeBell

ChargeBell connects to Stripe through Stripe Connect OAuth with read-only access. It can read your Stripe events, but it can't move money or change anything in your account. You can disconnect at any time.