In OAuth, you have basically two tokens: One for the "software"/"third party service provider", one for the account itself. So for example, if you want to use

In OAuth, you have basically two tokens: One for the "software"/"third party service provider", one for the account itself. So for example, if you want to use SomeMagicTweetTool to send tweets, they use their token to prove it's them, and you grant them a special token for your account. Someone who has their token can pretend to be them, use their quota if there is per-software/per-provider quota, but cannot access your account unless you gave them a token for your account.