How can we help?

OAuth is an authorization framework commonly used to connect applications without sharing the user's account password directly with the requesting application. When a service uses OAuth, the authorization process may display the resources or operations the connected application is requesting permission to access. These permissions are often represented as authorization scopes. What is an OAuth scope? A scope defines a particular category of access requested by an application. Depending on the provider, scopes may authorize operations such as: 1. Reading selected account information. 2. Accessing contact records. 3. Retrieving calendar information. 4. Creating or updating supported records. 5. Accessing organization-specific resources. The actual scopes depend on the external provider and integration. What happens during OAuth authorization? A typical OAuth connection involves the following steps: 1. The user initiates the connection. 2. The external provider presents an authorization interface. 3. The user authenticates with the external provider if required. 4. The provider displays the requested permissions. 5. The user approves or rejects the request. 6. The provider issues authorization credentials according to its supported flow. 7. The connected application uses those credentials to perform permitted operations. The exact sequence may differ between providers. Does OAuth give Polyosync access to my external account password? OAuth is designed to allow delegated authorization without requiring the connected application to receive the user's password. This does not eliminate the need to protect authorization tokens and other credentials. Can I approve only some requested permissions? Some providers support selective authorization. Others require approval of the complete requested scope set. The available choices depend on the provider. What happens if I reject authorization? The integration may remain disconnected or may be unable to perform operations requiring the rejected permissions. Why might an integration request several scopes? An integration may require different permissions for different supported operations. However, requested access should always be evaluated against the actual business purpose. Do OAuth permissions expire? Authorization credentials may expire or be revoked. Some providers support renewal mechanisms, while others require the user to authorize the connection again. Can I revoke OAuth access? Most OAuth providers offer account settings where users or administrators can review and revoke authorized applications. Revocation may prevent the integration from performing further operations. How can I evaluate an authorization request? Before approving access: 1. Confirm that the service is the intended provider. 2. Review the permissions requested. 3. Determine whether those permissions are necessary. 4. Check which account or organization is being authorized. 5. Consider whether the connection will access sensitive data. 6. Verify that the authorization request matches the intended business operation. Recommended approach Read the authorization screen carefully. Do not approve permissions that you do not understand or that appear unrelated to the intended integration.