Definition
OAuth (now at version 2.0) is an open standard that lets a user grant a third-party application limited access to their account without handing over a password. Instead of storing your Google password, an app stores an access token and (usually) a refresh token. Tokens are scoped - "read your calendar" is a different scope from "send email as you" - and can be revoked independently at any time.
OAuth has three main actors: the resource owner (you), the resource server (Google, Stripe, etc.), and the client (the app wanting access). The user is redirected to the resource server to consent, the resource server sends the client an authorization code, and the client exchanges that code for a token. Tokens live in the client app and must be protected like passwords.
How SheetLinkWP relates to OAuth
Since v1.12.0, SheetLink Forms' default Google Sheets connection is a one-click OAuth flow: click Connect Google, approve a standard Google consent screen, and pick your spreadsheet with the Google file picker. The requested scope is drive.file, so SheetLink only gets access to the spreadsheets you pick or create, never your whole Drive. The resulting refresh token is stored encrypted in your own WordPress database; SheetLink's OAuth broker at sheetlinkwp.com is contacted only to exchange and refresh tokens, and form payloads never pass through it.
Prefer no OAuth at all? The classic Apps Script webhook method is still fully supported: you deploy a script inside your own Google account and it runs as you, with no token ever leaving your Google tenant. For Multi-CRM Routing destinations like HubSpot and Salesforce, SheetLink uses OAuth where required by the destination vendor, and tokens are encrypted at rest.