# OAuth vs SSO

URL: https://softwaredictionary.org/compare/oauth-vs-sso
Last updated: 2026-10-02

In short: OAuth lets an app reach a user's data on another service without their password, while SSO is one login for many apps, built on SAML or OpenID Connect.

## What is the difference between OAuth and SSO?

OAuth 2.0 is an authorization framework. When an app asks to read your Google Calendar, OAuth lets you approve that on Google's own page, and Google gives the app an access token limited to that permission instead of your password. Single sign-on is a goal rather than a protocol: you log in once to an identity provider, such as a company's Okta or Microsoft Entra ID account, and are then let into many separate applications.

The difference is the question each one answers. OAuth answers "may this app do something on the user's behalf?", so it is about delegated access and scopes. SSO answers "who is this user, so they don't have to log in again?", so it is about identity and authentication across applications.

They meet in OpenID Connect, a layer on top of OAuth 2.0 that adds an ID token saying who the user is. "Sign in with Google" buttons and many modern SSO setups use OpenID Connect, while enterprise SSO also relies heavily on SAML, an older XML-based standard. OAuth is therefore often part of how SSO works, but OAuth on its own doesn't log anyone in.

A common misconception is that OAuth is a login protocol. An access token says what an app may do, not who the user is, and treating it alone as proof of identity has caused real security holes; for logging users in, use OpenID Connect or SAML.

| Aspect | OAuth | SSO |
| --- | --- | --- |
| What it is | An authorization framework (a protocol) | A way of logging in once for many apps |
| The question it answers | May this app act on the user's behalf? | Who is this user, across all our apps? |
| Main result | An access token with limited scopes | A logged-in session in each application |
| Built on | OAuth 2.0 (and the newer 2.1 draft) | SAML or OpenID Connect, often with OAuth underneath |
| Typical example | An app reading your calendar with your permission | Signing in to email, chat and HR tools with one company account |
| Main concern | Delegated access and permissions | Identity, and fewer passwords to manage |

## Choose OAuth when

- Your app needs to call another service's API on a user's behalf.
- You want to give third-party apps limited access to your own API.
- Users should grant and revoke permissions without sharing passwords.

## Choose SSO when

- Employees or customers use several of your applications.
- You want one place to manage accounts, passwords and multi-factor authentication.
- Disabling one account must remove access to every app at once.

## Frequently asked questions

**Is OAuth used for SSO?**

Often, through OpenID Connect, which adds identity on top of OAuth 2.0. Plain OAuth handles permissions, not logging in.

**What is the difference between SAML and OAuth?**

SAML is an XML-based standard used mainly for enterprise SSO; it passes signed statements about who the user is. OAuth is about giving apps access tokens, and with OpenID Connect on top it can handle logins too.

**Is "Sign in with Google" OAuth or SSO?**

Both, in a sense. It uses OpenID Connect, which is built on OAuth 2.0, and it gives you single sign-on across the sites that accept your Google account.

---

Software Dictionary: https://softwaredictionary.org/ · https://softwaredictionary.org/llms.txt