What OAuth Actually Does

OAuth is an authorization protocol that gets you a token on behalf of a user. 'Sign in with Google' is that protocol used for identity, which is strictly speaking OpenID Connect layered on top of it.

The flow, in plain terms: you send the person to the provider, they approve, the provider sends them back with a short-lived code, and your server exchanges that code for a token. The exchange happens server-side because it needs your client secret.

What it buys and what it costs.

Buys: no passwords to store, no reset flow to build, and a sign-up that takes one click, which measurably increases the number of people who complete it.

Costs: a dependency on somebody else's availability and policies, an account recovery story you no longer control, and people who cannot or will not use that provider. Offer it alongside email and password rather than instead of it, unless you have a specific reason.

✦ The email is not proof of identity by itself

A provider tells you the email address. Trusting it to match an existing account without checking the provider verified it is how accounts get taken over: somebody registers that address at a provider that does not verify, signs in, and lands in the existing account. Check the verified flag, and think carefully before automatically linking accounts by email.