What is OAuth sign-in?
When you connect an AI agent to Spaces, or to many other services, a browser window opens, you sign in, and you are asked to approve access. That short step has a name: OAuth. You have probably used it many times without knowing, every time you clicked "Sign in with Google" on a website. Here is what it is, what you are actually agreeing to, and why it is often the safer way to connect.
In one sentence
OAuth sign-in is a way of letting one app use another service on your behalf without giving it your password: you sign in on the service's own page, approve what the app may do, and the app receives a pass that only works for that. You can take the pass away later without changing your password.
In more detail
Think of a hotel key card. At reception you prove who you are once. The hotel then gives you a card that opens your room and the gym, but not the kitchen or other guests' rooms. If you lose it, reception cancels that card and issues another. Your identity and your passport stay with you the whole time. OAuth works much the same way.
When your AI app connects with OAuth, it sends you to the service's own sign-in page. You type your email and password there, on the service's page, not into the AI app. The service then asks whether you want to allow this app to connect. When you approve, the service hands the app a pass, which techies call a token. The app keeps that pass and shows it each time it uses the service.
The pass is not your password. It can only do what the service allows that connection to do, it can expire and be renewed quietly, and it can be cancelled from the service's side at any time. That is the main reason OAuth is popular: the app never sees your password, and you can cut it off cleanly.
The alternative is an API key: a long secret string you copy from the service and paste into the app's settings. Keys work well, especially for programs running on a server, but they have to be copied, stored and protected by you. If a key ends up in an email, a screenshot or a shared document, anyone who sees it can use it until it is revoked.
There are two different sign-ins in a typical set-up, and it helps to keep them apart. One connects your AI agent to Spaces. The other connects your business accounts, such as Instagram or LinkedIn, to Spaces. The example below walks through the first one for Claude. Names and details are examples.
An example
| Step | What you see and do |
|---|---|
| 1. Add the connector | In Claude, you add a custom connector named Spaces with the address https://api.spacesos.com/mcp. |
| 2. Sign in | You choose to sign in. A browser page opens on the Spaces website and asks for your Spaces email and password. |
| 3. Approve | Spaces shows that Claude wants to connect to your workspace. You approve. |
| 4. Back in Claude | Claude now lists the Spaces tools. You never copied or pasted a key. |
| 5. Later | You decide to stop using Claude for messages. You remove its access in Spaces, and its sign-in stops working straight away. |
OAuth sign-in or API key: the difference
| Question | OAuth sign-in | API key |
|---|---|---|
| What you do | Sign in in the browser and approve once | Copy a secret from Spaces and paste it into the app |
| Does the app see your password? | No, you type it on the service's page | No, but the key itself is a secret you must guard |
| Where the secret lives | Kept by the app after you approve | Wherever you pasted it, so you must store it safely |
| Best for | Chat apps and agents on your own computer | Programs on a server, or apps that only accept a header |
| How to stop it | Remove the agent's access in the service | Revoke the key, then make a new one if needed |
| Risk if mishandled | Low, as long as you only sign in on the real page | Anyone who sees the key can use it until it is revoked |
Both are safe when handled properly. For most owners, signing in is simpler and leaves fewer secrets lying around.
What you are agreeing to when you click approve
The approval screen is worth reading, because it is the moment you decide what the app may do. In general, approving an OAuth connection means:
- The app may use the service as you, within what the connection allows, until you remove it.
- The app does not get your password, and changing your password is not usually needed to remove it.
- The service can tell which app did what, because each connection has its own pass.
- You can see and remove the connection from the service's side.
If an approval screen asks for more than the app obviously needs, or appears when you were not trying to connect anything, close it.
Staying safe with sign-in links
- Only sign in on a page you reached by starting the connection yourself, from inside your AI app.
- Check the address bar shows the service you meant to sign in to before typing your password.
- Never approve a connection from a link someone sent you in a message, even if it looks official.
- If a sign-in asks for a code sent to your phone, type it only on that same page.
- Remove connections you no longer use. An old connection you forgot about is still a way in.
What if…
| What if… | What to do |
|---|---|
| The sign-in page does not open? | Check your browser is not blocking pop-ups, then start the connection again from inside the AI app. Restarting the app often helps. |
| A freelancer set up the agent with their own login? | Ask them to sign the agent in with your workspace instead, or set it up again yourself, so access stays with your business. |
| You think someone else has access? | Remove the agents you do not recognise under Your agent, change your Spaces password, and pause sending while you check. |
| The AI app says the connection has expired? | Sign in again from the app. Your settings and connected accounts in Spaces stay as they were. |
Common mistakes
- Mixing up the two sign-ins. Signing your AI agent in to Spaces does not connect Instagram. Connecting Instagram is a separate step, done on its own connect page.
- Signing several different agents in as if they were one. Each agent that signs in gets its own access in Spaces, which is useful, so keep them separate.
- Pasting an API key into a chat. If you prefer keys, put them in the app's settings or an environment variable, never in a message.
- Forgetting to remove access when you stop using an app or a freelancer leaves.
Why it matters for your business
- You connect your AI agent without copying secrets around, so there is less to leak.
- Each app gets its own pass, so you can see what each one does and stop one without touching the others.
- Taking access away is one step in the service, with no password change.
- Knowing what a real sign-in looks like helps you spot fake approval pages and phishing links.
- It keeps the agent's access to your messages under your control, which matters when it can reply to customers.
How Spaces handles it
Spaces supports OAuth sign-in on its MCP server, and the setup steps on the agents page use it for Claude, Claude Code, ChatGPT, Grok, Cursor, Codex, OpenClaw and Hermes. You sign in to Spaces with your email and password in the browser and approve access once. API keys still work for clients that prefer a header, or for programs running on a server.
Every agent that signs in or uses a key is listed under Your agent in Spaces, with its own permissions (read, reply, post and comment, connect accounts, ads), its own accounts, its own share of each day's sending and its own pause. Removing an agent there stops its key and its sign-in working.
Connecting a business account is a separate step. WhatsApp links by scanning a QR code. Instagram, LinkedIn, Messenger, X and email ask you to sign in to that account on a connect page, and if the platform asks for a second factor, you complete it on that page.
In short
OAuth sign-in is the "sign in and approve" step that lets an app act for you without ever holding your password. It gives each app its own pass that you can cancel at any time.
Use it for your AI agent where you can, sign in only on pages you opened yourself, and tidy away connections you no longer use.
FAQ
Is OAuth safer than an API key?
For most owners it is simpler to keep safe, because there is no secret to copy, paste or store. Both are safe when handled well. Keys suit programs on servers; sign-in suits chat apps and agents on your own computer.
Does the AI app see my Spaces password?
No. You type your password on the Spaces sign-in page in the browser. The AI app only receives a pass that lets it use the Spaces tools until you remove it.
How do I take an AI agent's access away?
Remove the agent under Your agent in Spaces. Its sign-in and any key it used stop working straight away, and your other agents are not affected.
Do I need to sign in again every day?
Usually not. The pass is renewed quietly in the background. You may be asked to sign in again if you remove the connection, change some settings or the app asks for a fresh approval.
Is signing my agent in to Spaces the same as connecting Instagram?
No, they are two separate steps. Signing in connects your AI agent to Spaces. Connecting Instagram, LinkedIn, Messenger, X or email means signing in to that account on a Spaces connect page; WhatsApp links with a QR code.
What if I get an approval page I did not ask for?
Close it and do not approve. A real sign-in only appears when you start the connection yourself from inside your AI app. If you are unsure, start again from the app.
Can I use a key instead of signing in?
Yes. Most clients can send an API key as a header instead. Store the key in the app's settings or an environment variable, never in a chat or a shared document.