I am frequently seeing websites that allows a user to log-in to their site using other websites log-on credentials. If there is a page that allows me to log-in using my google account or facebook account, will the former site could get my google/facebook login details?

  • If the domain that you enter your credentials on is that of your account (e.g. Google), then your credentials are only going there (i.e. to Google). If however, there is a form on the site you want to log into and it asks for your Google credentials then these will be going to the site in question that could be storing them or misusing them. Commented Jan 23, 2015 at 9:57

1 Answer 1


Sites like Google and Facebook implement protocols such as OAuth to accomplish what you describe and what is known as Delegated Authorization.

In short, the answer to your question is no. Sites that allow you to sign in with your other accounts never see your account credentials. In simple terms, Google / Facebook are creating a limited use token that links you to your account that may be used to access some of your information on Google / Facebook. Typically, it goes like this:

  1. The client (other website) obtains a token from the server (Google for Example)
  2. The client requests authorization from the Resource Owner (you)
  3. The resource owner validates the request and grants authorization.
  4. The client exchanges the request token for an access token.

There are different methods (flows) that achieve this same principle. You can read more about it here:


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .