The button says "Continue with Google." You tap it, the page blinks, and suddenly you're inside an account you never had to name, verify, or invent a password for. Most people run this flow dozens of times a year without ever looking at what sits behind it. That's a shame, because the gap between a tidy connected app and one quietly reading your calendar comes down to details you can check in about two minutes.

What the button actually starts

Sign in with Google, Apple, Microsoft, Facebook — they all lean on the same machinery: OAuth 2.0 for authorization, and usually OpenID Connect layered on top for identity. The distinction sounds academic. It isn't.

OAuth answers one question: may this app access this resource on my behalf? It hands out tokens instead of passwords, and tokens can be scoped, expired, and revoked. OpenID Connect adds a standard identity layer on top, so the app can learn who you are rather than only what it's allowed to touch.

The practical upshot: the site you're signing into never sees your provider password. It receives a token and, typically, a small bundle of profile claims. That's a real improvement over reusing the same password everywhere — as long as you know what's in the bundle.

The handshake, step by step

Here's the sequence behind a typical Google or Microsoft sign-in, stripped of jargon:

1. You click the button. Your browser is sent to the provider with a client ID identifying the site and a list of permissions it wants.
2. The provider checks whether you're already signed in there. If you are, it skips the password prompt entirely — which is why the whole thing takes a second.
3. A consent screen lists the requested permissions. You approve, or you don't.
4. The provider sends your browser back to the site with a short-lived, one-time authorization code.
5. The site's server trades that code for an access token, and often an ID token, in a direct server-to-server call secured by a secret your browser never sees.
6. The site reads the claims it asked for, then creates its own session cookie. From that moment you're logged in to the site, not to the provider.

Two details matter here. The token exchange happens out of sight of your browser, and every token carries scopes and a lifetime. A careful site asks for the minimum and refreshes as needed; a sloppy one asks for everything on day one.

What profile data gets shared

Everything hinges on scopes — the labels on that consent screen. For a plain sign-in flow you're usually granting something close to:

• A stable user ID, so the provider can recognise you next visit without handing over your email.
• Your email address, often with a flag saying whether the provider has verified it.
• Basic profile fields: display name, profile picture, sometimes locale or language.

That's a modest list, and it's what most sites genuinely need. But the same screen can request far more — contacts, calendar entries, files in cloud storage, permission to post as you. If a site that only needs your name asks for your contacts, treat that as a signal rather than an accident.

Watch the email-linking effect too. Sign in with the same address on two services and they can confidently tie those accounts to one person. Convenient for you, and convenient for ad networks if the site shares what it learns.

One hard rule: once data has been shared, it has been shared. Revoking access later stops future reads. It does not reach into the site's database and delete the name and email already stored there.

What the provider learns in return

The traffic isn't one-way. The provider sees that you signed in to a particular app, when, and how often. Over a few years, that pattern is a decent portrait of which services you depend on.

Some providers see more. If the site embeds the provider's JavaScript, analytics, or advertising pixels, the provider may see you browsing pages that have nothing to do with login. The reverse holds as well: trackers on a page can often read the provider's cookies. That's why sign-in buttons frequently arrive bundled with tracking.

None of this makes social login a bad idea. It means the button is a trade — less password reuse, more linkage.

How to audit connected apps

Set aside ten minutes. You will be surprised by what is still connected from years ago.

1. Google: open your Google Account, go to Security, then find "Third-party apps with account access" (sometimes listed under Connections). Review each entry, check what it can access, and remove anything you don't recognise.
2. Microsoft: sign in at account.microsoft.com, open Privacy, then "Apps and services". Same process.
3. Apple: on iPhone or Mac, open Settings, tap your name, then "Sign in with Apple", and review which apps use your Apple ID.
4. Facebook: Settings & privacy → Settings → Apps and websites. Remove old entries and check whether any are allowed to post publicly.
5. Work from the other end. On each service you actually use, look for "Connected accounts" or "Linked accounts" in settings. That's where the provider link lives, and usually where you can set a password and detach it.
6. Check your saved logins. Skim your password manager or browser vault. Every account there you don't remember creating is a candidate for cleanup.

When to revoke — and what revocation doesn't do

Revoke when an app is unused, when it asked for more than it needs, when the company behind it changes hands, or when it turns up in a breach notification. Do it before you forget the account exists.

Three cautions. First, if you created an account purely with the social button and never set a password, revoking can lock you out — set a password in the site's own settings first. Second, revoking rarely deletes your account there; it just cuts the link. Third, some sites simply re-request access the next time you sign in, so a revoked app can quietly reappear.

If any of this touches a work account, or data you handle on behalf of other people, involve your organisation's IT or legal team before you start cutting links.

A habit worth keeping

Twice a year, do three things: scan your provider's connected apps list, remove anything you don't recognise, and set a password on any account where the social button is the only way in. Ten minutes every six months buys you something simple and valuable — a clear idea of who holds a key to your identity.