What Is OAuth Token Sprawl? Risks and Prevention

In April 2026, Vercel disclosed that attackers had gained access through a compromised third-party AI analytics application, Context.ai, which a Vercel employee had connected to their Google Workspace account through OAuth. The incident showed how a trusted third-party connection can become an unexpected path into corporate data.

That is where OAuth token sprawl becomes a security problem: third-party connections can accumulate across an organization without a clear record of what was authorized, why it was authorized, or whether the connection is still needed.

What OAuth token sprawl actually is

OAuth is the authorization standard behind almost every "Sign in with Google" or "Connect your Microsoft account" button. An employee clicks through a consent screen, grants a third-party app access to some slice of their account, email, files, calendar, and the app receives a token that keeps that access valid going forward, without requiring the employee to log in again each time.

That's convenient by design, and also part of the problem. An OAuth token can remain valid independently of a user's normal password lifecycle, depending on how the identity provider and application handle expiration and revocation. Once issued, a token may continue to authorize access until it expires or is explicitly revoked. Token sprawl is what happens when a company accumulates dozens or hundreds of these connections over time, across every employee, with no central record of what's been granted, what data it can reach, or whether anyone's still using the tool it was connected to in the first place.

Why it accumulates so easily

Consent happens at the individual level, with no central review. An employee grants OAuth access through their own account in seconds, and unless a company has restricted third-party app consent entirely, that grant typically doesn't route through IT or security at all.

Trials and abandoned tools can leave their connections behind. An employee tries a tool for a project, the project ends, and the tool gets forgotten, but the OAuth grant it was given doesn't automatically get revoked along with it. Without a specific process to catch this, the connection can remain valid long after anyone remembers granting it.

Permissions granted are often broader than the task requires. Many OAuth consent screens request wide-ranging access, read and sometimes write permissions across email, files, or calendar, well beyond what the specific feature a user wanted actually needs. Users click through consent screens quickly, and the gap between requested and actually-needed access rarely gets questioned.

Nobody owns the ongoing review. Unlike a licensed SaaS subscription with a renewal date that eventually forces a decision, an OAuth token has no natural expiration event built around business review. Without someone specifically auditing connected apps, a token can remain valid for a long time without anyone deciding it should.

Why this has become a real breach vector

This isn't a theoretical risk. The 2025 Salesloft-Drift incident showed how compromised OAuth credentials can become a pathway into connected customer environments. Attackers obtained OAuth tokens associated with Drift integrations and used those tokens to access data through connected systems, without needing to compromise each target organization's own defenses directly.

Verizon's 2026 Data Breach Investigations Report found that third-party involvement appeared in 48% of breaches, highlighting how much security risk can sit outside an organization's own systems. Taken together, these incidents point to a consistent pattern: attackers increasingly don't need to breach the target company directly. Compromising one smaller, less-defended third party the target has connected to can be enough, since a valid token doesn't require fresh credentials to keep working.

How to find and reduce token sprawl in your own stack

Audit every third-party app connection across Google Workspace and Microsoft 365. Both platforms provide an admin view of connected apps and the specific permissions each one holds. Most companies that run this audit for the first time are surprised by how long the list actually is.

Check when each connected app was last actually used, not just when it was authorized. A token still holding valid access for a tool nobody's opened in months is exactly the kind of connection that's easy to overlook, and it's usually invisible without specifically checking usage.

Revoke access for any tool tied to a trial that's ended or a project that's wrapped up. These are consistently among the higher-risk connections, since they were granted for a specific, time-limited purpose that nobody remembers to close out afterward.

Restrict third-party app consent to require admin approval, rather than letting any employee grant access unilaterally. Several major platforms are moving toward this as a default setting, which signals how seriously the underlying risk is now being treated at the platform level.

Tie OAuth review to offboarding, not just account deactivation. Deactivating someone's account doesn't automatically revoke every third-party app they'd personally authorized. A departing employee's OAuth grants need a specific check as part of the offboarding process, not an assumption that account deactivation covers it.

Review connected apps on a recurring schedule, not as a one-time cleanup. New connections get created constantly as employees adopt new tools. A single audit finds what's accumulated so far; a recurring review is what actually keeps the list from growing back to the same size within a year.

Where OptyStack fits

Manually auditing every OAuth connection across Google Workspace and Microsoft 365, and cross-referencing each one against actual usage, is realistic for a handful of apps and becomes genuinely difficult once a company has accumulated the kind of sprawl most organizations actually carry.

OptyStack surfaces connected third-party applications and their usage patterns across your SaaS estate, so dormant and forgotten connections are visible in one place instead of requiring a manual review across separate admin panels.

It's free to start and doesn't require a credit card.

See every third-party app connected to your stack. Start free with OptyStack.