There is a clean line here, and the cost of getting it wrong runs in both directions - friction kills adoption of an app that should have been open, and skipping auth on sensitive data leaves a wide-open door. One costs users, the other costs security.
OAuth is mandatory when your app handles private or sensitive data; when it is for internal use or a small specific audience; when you need per-user rate limiting or audit trails (you cannot attribute either without identity); or when you need role-based access control, because different people should see different things.
It is optional for public demo apps, where frictionless access is the point and a login wall measurably reduces casual usage.
The nuance worth knowing: even for a public app, OAuth buys you things beyond access control - user behaviour monitoring, a contact list, and abuse tracking tied to real identities rather than IPs. So it is not purely a security question; it is a product one. The trade-off is real friction, and for a public app it is genuinely your call.
For a private app there is no call to make.
Once you have decided, choosing the provider is the next decision, and knowing which of your gates are real is the one after that. Full item: https://www.tigzig.com/security/auth.
← All Agents FAQ