The password anti-pattern
In 2008, an app that wanted to import your contacts asked you for your email password. The big social networks did exactly this for their find-your-friends features.
Sit with what that meant. Users typed the password to their primary email account, the account that can reset every other password they own, into a third party's form.
That app then had everything. The contacts, yes, and also the ability to read mail, send mail, and delete the account. There was no way to grant less, no way to see which apps held access, and the only revocation was changing your password, which broke every connected app at once.
Four roles
OAuth restructures that interaction into four roles, and getting the names straight makes half of every OAuth conversation mechanical.
The resource owner is your user. The client is the app that wants access. The authorization server is where the user actually authenticates and approves. The resource server is the API holding the data.
Notice where the credentials go now. Only to the authorization server. Your client receives a scoped, revocable token instead.
Use scopes as the mechanism for granting less: read-only contacts rather than the entire account. The consent screen lists what is being asked for, and your user can simply walk away. Revocation is per app in their account settings, one grant killed without touching the others.
Note what OAuth deliberately does not claim, because this trips people up. The framework is about authorization only. A token means the holder may read these contacts, not the holder is this person.
Teams that treated one as the other shipped real login bypasses, and the fourth lesson covers the layer that fixes it.
Worked example
Yelp's 2008 signup flow had a step that asked new users for their email address and their email password, then logged into the inbox over IMAP to scrape the address book and invite everyone in it. Tech press called it out repeatedly, but the practice was industry standard because no alternative existed at consumer scale. Run the same feature today: Yelp redirects you to a Google consent screen requesting the contacts.readonly scope, Google checks your password (Yelp never sees it), and Yelp receives a token that can list contacts and do nothing else. A year later you can open myaccount.google.com/permissions, see Yelp in the list, and cut it off with one click while your other connected apps keep working. Same feature, and the trust required went from total to almost none.