When you add a Sign in with Google button or let your app read a user's GitHub repositories, you are using OAuth. The user approves specific permissions on the provider's own page, and your app receives a token that carries only those permissions. Your app never handles the password.
OAuth is easy to wire up and easy to get subtly wrong. Common mistakes in generated code are asking for far more permissions (scopes) than the feature needs, accepting any redirect URL instead of an exact registered one, skipping the state value that ties a login response to the browser that started it, and putting the client secret in frontend code where anyone can read it.
Also note that OAuth on its own is about authorization, meaning what your app may do. Proving who the user is comes from OpenID Connect built on top of it. Use a maintained library or your auth provider's SDK instead of hand-writing the flow, register exact redirect URLs, request the narrowest scopes, and keep the client secret on the server only.
https://accounts.example.com/authorize?response_type=code&client_id=YOUR_ID&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&scope=read%3Aprofile&state=RANDOM_PER_LOGIN