​

OAuth Protection

OAuth protection adds a sign-in step before users can access sensitive features in your app. When enabled, users are prompted to connect their account before protected tools or data become available.

​

When to Enable OAuth

Turn on OAuth when your app:

• Reads or writes user-specific data (account details, order history, personal settings).
• Performs actions that must be tied to a specific user identity.
• Accesses protected resources that require an access token from a third-party service.

If your app only displays public information or uses app-level API keys, you do not need OAuth.

​

What the User Sees

When a user opens an OAuth-protected app in ChatGPT, here is what happens:

1. The user opens the app and starts a conversation.
2. When they trigger a protected feature, ChatGPT prompts them to connect or sign in to the required service.
3. The user completes sign-in in a pop-up window.
4. They return to the conversation with protected features unlocked.

The sign-in flow is handled entirely by ChatGPT. You do not need to build a login UI.

​

Enable OAuth on Your App

​

Design Guidance

Not every feature in your app needs to be behind OAuth. A good pattern is to keep low-friction features open and gate only the sensitive ones. Open features (no sign-in required):

• General information lookups
• Public data searches
• Help and FAQ tools

Protected features (sign-in required):

• Viewing account details
• Placing orders or making changes
• Accessing billing or payment data

This approach reduces friction for casual users while protecting actions that require identity verification.

​

Testing OAuth in Preview

​

Troubleshooting

​

What’s Next