Connect a Gmail or Google Workspace mailbox (campaign) using the OAuth 2.0 refresh-token flow. Unlike Connect a Google Mailbox (App Password), the mailbox owner authorizes through Google's consent screen and never generates or shares an app password.

The partner performs the Google OAuth consent flow and supplies Mailivery with a long-lived google_refresh_token plus an initial google_token. Partners do not need to push fresh access tokens over the lifetime of the campaign.

Before you start — save your Google OAuth credentials in Mailivery. Token refresh uses your own Google Cloud OAuth app, so Mailivery needs that app's credentials on file. In the Mailivery app, go to Settings → Team Settings → API Access and fill in the Google OAuth Credentials form: paste the Client ID and Client Secret from your Google OAuth app, then click Save Credentials. The values are stored encrypted and are not displayed again after saving. Save them before you create your first OAuth mailbox — a mailbox created beforehand connects successfully, but cannot refresh its access token once the initial one expires.

Technical detail. Mailivery authenticates to Gmail's IMAP and SMTP servers using the XOAUTH2 SASL mechanism, exchanging the stored refresh token for short-lived access tokens as needed. The Google scope must be the full https://mail.google.com/ scope; narrower scopes are not sufficient for IMAP XOAUTH2.