OAuth tokens operate on a token-based authentication system. When a user authorizes an application to access their email service, an OAuth token is generated. This token grants the application specific permissions, such as sending emails or accessing email analytics. The token can be limited in scope and duration, enhancing security by reducing the potential for misuse.