36Blocks' OAuth 2.0 module lets your block act as its own OAuth 2.0 authorization server. Instead of your users ever handing out their password, a third-party application can request delegated, scoped access to their account on your platform. It's the same shape as "Connect to GitHub" or "Sign in with Google," but for your own product, under your own control.

You decide which third-party applications are allowed to connect, and exactly what each one can access. Your user is always the one who approves or denies the request, on a consent screen you host yourself, and can revoke that access at any time.

• Partner and marketplace integrations: let other products connect to a user's account on your platform and read or act on their data, without ever seeing their credentials.

• Your own first-party apps: a mobile app, CLI, or separate web app that needs to act on behalf of a logged-in user, authenticated the same standards-based way as any external integration.

• Scoped, revocable access: grant a connecting app only what it actually needs (built-in identity fields, or custom scopes specific to your own product), and cut off access instantly, per connection or per integration, whenever you need to.

• An ecosystem around your product: once this is set up, any developer can build against it using standard OAuth 2.0 (authorization code + PKCE, refresh tokens, a userinfo endpoint) without needing anything custom from you beyond registering their app.