OAuth

What is OAuth?

OAuth (Open Authorization) is the industry-standard authorization protocol. It lets a third-party application access your account on another service without you sharing your password. Instead, you grant specific permissions and can revoke them at any time.

It powers:

• "Sign in with Google" on third-party sites
• Connecting Mais Social to Instagram, TikTok, LinkedIn
• Calendly accessing your Google Calendar
• Paid-media apps accessing Meta Ads Manager
• Zapier integrations

Current version

Today (2026) the standard is OAuth 2.0. 1.0 is deprecated. Practically every major platform uses 2.0 or variants (OIDC for authentication).

How it works — step by step

1. You click "Connect Instagram" on Mais Social
2. Mais Social redirects your browser to https://api.instagram.com/oauth/authorize with parameters (client_id, scope, redirect_uri)
3. You log in to Instagram (if not already)
4. Instagram shows "Mais Social is requesting access to: [permission list]. Authorize?"
5. You click Authorize
6. Instagram redirects back to Mais Social with a code
7. Mais Social exchanges that code for an access_token (server-side call)
8. With the token, Mais Social can call the Instagram API on your behalf

Core concepts

• Scopes: specific permissions (read posts, publish, read metrics, etc.)
• Access token: temporary key proving authorization
• Refresh token: long-lived token to renew access tokens
• Client ID and Client Secret: identification of the authorized app
• Redirect URI: URL where the service returns the user after authorization

Practical example — Instagram scopes

When Mais Social requests authorization, the user sees something like:

• instagram_basic — read profile
• instagram_content_publish — publish posts on your behalf
• instagram_manage_insights — read metrics
• pages_show_list — list connected Facebook pages

The user understands exactly what they're granting. To revoke access later, they just go to the network's "Connected Apps" and remove it.

Best practices

• Request only the scopes needed (principle of least privilege)
• Store encrypted tokens in the database
• Renew with refresh token automatically
• Implement logout / disconnect with revocation
• PKCE in mobile apps and SPAs (more secure)

Common mistakes

• Requesting every available scope (user gets suspicious)
• Not handling expired tokens (app breaks silently)
• Saving Client Secret in the front-end (leak)
• Not validating the state parameter (vulnerable to CSRF)
• Not offering a clear disconnect option

To the end user, OAuth is invisible: click "Connect Instagram", authorize, done. All complexity lives in the Mais Social backend.