If I trust the website, email. If I don't trust them oAuth. oAuth implementations don't give the developer my password and generally disclose any permission red flags.