How it works
OAuth is an authorization protocol that lets an app access a user's resources on a service without the user's password being shared. The classic authorization code flow starts when the user clicks "Sign in with X". The app redirects the user to the provider, which asks for confirmation. After authentication, a code is exchanged for an access token. That token lets the app call the service API for the authorized actions, for a limited time. Each app requests only the scopes it needs, which limits what it can read, and the user decides whether to approve the request. Permissions can be reviewed at any time in the provider's dashboard, and a refresh token lets access continue without a new password.
Practical example
A scheduling site asks permission to read the user's name and email from an email service. The user confirms, the site receives a token and can display the email, without ever seeing the service password. If the site is revoked, the token becomes invalid and access ends. The user can revoke access at any time in the provider's dashboard, without changing the password for other services. The access token has a limited lifetime, and a refresh token lets access continue without asking for the password again.
What it's for
OAuth is for letting apps and services share data securely, enabling granular access, session revocation and security best practices, instead of sharing credentials between systems. Tokens have limited lifetime and defined scopes, which reduces damage if a token is leaked. Fast revocation also makes the flow safer than sharing a password with each app, especially in corporate environments where access control is mandatory.
Difference between X and Y
OAuth authorizes access to resources; it does not confirm the user's identity. Authentication is usually done with OpenID Connect, which can be used together with OAuth in the same flow.