Products · Product
OAuth
Raised as a usability problem by 58 people on Hacker News over 18 years (2009–2026), in 46 threads.
No issue was raised by at least 3 people in 3 threads this year.
Every issue, all time, most people first
Sign-in becomes complicated when it goes wrongUnreviewed
20092026- OAuth is too complex to set up and use for app-to-app authentication2026-06-25
- OAuth and enterprise auth are confusing and frustrating to set up and use2026-06-25
- OAuth consent dialogs are outdated and hard to understand for users2026-04-21
Must click twice to log in even after daily authenticationUnreviewed
20092026- Users must manually click "try now" and lose auth when the device restarts2023-04-27
- Users must click at least twice to log in, even after authenticating once per day2021-03-04
- Keeps forgetting the user, forcing them to log in again repeatedly2015-10-26
Unreviewed issues were grouped by machine: Claude Haiku labelled each comment as a usability complaint, named what it's about and summed up the problem in a line, and a small model grouped similar problems. Nobody has checked them by hand. Expect mistakes.
The newest 50 complaints
- OAuth is too complex to set up and use for app-to-app authentication2026-06-25
- OAuth and enterprise auth are confusing and frustrating to set up and use2026-06-25
- OAuth consent dialogs are outdated and hard to understand for users2026-04-21
- Setup flows designed for humans clicking web forms block autonomous agents2026-03-26
- Diagram is confusing, with multiple boxes for the same entities2026-02-22
- Central paragraph is hard to parse, with undefined terms and unclear 'first half' references2026-02-21
- Users never know whether to log in with GitHub or Google, leading to multiple accounts2025-12-28
- Too many separate flows, each authorized separately with its own limits, hard to understand2025-01-29
- Signing in with a social account silently creates a new account instead of linking the existing one2024-12-12
- Standard is hidden behind a huge wall of text, hard to read2024-12-12
- Users don't understand that approving a login grants a third-party service access to their data2024-09-28
- Pictures overflow past the right edge and scrolling feels sluggish on iPhone2024-09-05
- Login takes multiple minutes due to many sequential round trips and slow identity providers2024-09-05
- Laypeople can't tell whether the service gets their password, and the flow is too confusing to understand2023-09-01
- Users must manually click "try now" and lose auth when the device restarts2023-04-27
- Docs are long and hide the simple auth flow behind libraries and frameworks2023-04-26
- Docs reuse similar terms for generic and specific meanings, making them confusing2023-04-26
- Users reflexively click the big green proceed button without reading permissions2022-12-09
- Users click the big green proceed button reflexively without reading the permissions2022-12-09
- Cancelling the permissions request just sends the user back through the flow2022-12-09
- Ordinary users can't understand how OAuth works, so they can't tell when they're using it securely2022-09-26
- Hard to configure scopes and token flows, with popup blockers getting in the way2022-01-01
- Users are confused by the login-and-grant-access prompt asking to authorize another app2021-03-28
- Requested permissions are opaque, and users cannot grant only a subset of resources2021-03-17
- Users must click at least twice to log in, even after authenticating once per day2021-03-04
- Authentication and authorization terminology is confusing, especially outside the native application2020-10-08
- Users find it hard to understand how dangerous the login flow is2020-09-14
- Login page opens inside the app hiding the URL, so users can't verify the real sign-in site2020-09-07
- Docs and RFCs repeatedly reread; unclear whether JWTs are required2020-09-06
- Can't remember which service a site was signed up with via OAuth2020-08-16
- RFCs are confusing and unclear how they fit together2020-07-16
- Each provider's auth flow differs slightly, and app registration is a hassle2020-05-05
- Confusing mix of patterns, uses, and v1/v2 differences; person still gets confused2020-04-14
- Adding OAuth login is hard to do; no built-in simple setting, so developers struggle each time2019-01-23
- Developers must juggle many fiddly OAuth details like grant choice, client secrets and token refresh2019-01-23
- Mockups confusingly say domain while user logs in with a URL2018-07-07
- Users can't understand the permissions they're asked to grant, so they just click yes2018-03-23
- Users can't limit scopes, see what data was accessed, or understand what permissions mean2016-03-01
- Keeps forgetting the user, forcing them to log in again repeatedly2015-10-26
- Hard to implement correctly because libraries and documentation are lacking2015-10-23
- OAuth sign-in flow has a lot of friction for users2015-10-23
- Spec is hard to follow; reader must jump back and forth to understand it2014-10-15
- OAuth sign-in is bad desktop and mobile UX compared with stored passwords2014-07-01
- Took about 15 seconds to understand what was changing on the page2013-05-27
- Users are trained to trust redirects, and some hide the address bar so they can't verify the site2013-03-22
- Embedded login webview is a poor experience for users2013-03-07
- OAuth sign-in is a shitty UX that gets complicated when it goes wrong2012-09-26
- Scripts without a human cannot get access; setup is a multistep process needing a technical person2012-08-01
- Too many optional variants mean the standard is implemented differently by each vendor2012-07-26
- Hard to debug; code is a labyrinth when something goes wrong2012-04-04