OAuth sign-in URL builder for email
Build the OAuth 2.0 sign-in request your app needs for IMAP, POP, and SMTP – with the right scopes and PKCE – then test it and get the commands to exchange the code for tokens.
Everything is built in your browser – your client ID and codes are never sent to our servers.
Must match your app registration’s “Supported account types”.
Must exactly match one registered for your app (including any trailing slash).
1. Sign-in URL
| Scopes | |
|---|---|
| PKCE code verifier | Keep this – it’s needed to exchange the code. The URL contains its SHA-256 hash (the code challenge). |
| State | |
2. Paste the address you were redirected to
After signing in, your browser is sent to your redirect URI with a code (or an error). If nothing is listening there, the page won’t load – that’s fine: copy the address from the address bar.
3. Exchange the code for tokens
Codes expire within a few minutes and can only be used once. Add client_secret if your app is a confidential (web) app.
Refreshing the access token later
Check the access token you receive with our OAuth token decoder, which also builds the XOAUTH2 string to sign in with.
App-only access (no user sign-in)
Background services can use the client credentials flow instead, with the IMAP.AccessAsApp, POP.AccessAsApp or SMTP.SendAsApp application permissions. It needs admin consent, a client secret or certificate, and each mailbox must be granted to the app in Exchange Online – see our PowerShell command builder.
Setting up the app registration
- In the Microsoft Entra admin center, open App registrations → New registration. Choose the supported account types (this decides the tenant you can use above).
- Under Authentication, add a platform and the redirect URI. Use “Mobile and desktop applications” for desktop apps and scripts (with
http://localhost), or “Web” for server-side apps. For desktop apps, turn on “Allow public client flows”. - Under API permissions, add permissions → APIs my organization uses → Office 365 Exchange Online → Delegated permissions →
IMAP.AccessAsUser.All,POP.AccessAsUser.Alland/orSMTP.Send. (The same permissions under Microsoft Graph also work for user sign-in, but the token must be requested with the Outlook scopes shown above.) - If users can’t consent themselves, an administrator needs to grant consent – use our admin consent URL generator.
- For SMTP, check that SMTP AUTH is enabled for the mailbox – OAuth sign-in still needs it.
- In the Google Cloud console, create a project, then set up the OAuth consent screen (Google Auth Platform → Branding, Audience and Data access).
- Add the
https://mail.google.com/scope. It is a restricted scope: apps used by people outside your Google Workspace organization need Google’s verification (and a security assessment) before they can be published. While the app is in testing, only the test users you add can sign in, and refresh tokens expire after 7 days. - Create an OAuth client ID (Clients → Create client). Choose “Desktop app” for desktop apps and scripts (any
http://localhostport is allowed), or “Web application” with your exact redirect URI. - Google only returns a refresh token the first time a user consents – this tool adds
access_type=offlineandprompt=consentso you always get one.
Need OAuth email without writing OAuth code?
Auth-Email handles sign-in, consent, token refresh and XOAUTH2 for you. Your app, script or device connects to IMAP, POP, and SMTP with a simple username and password, and Auth-Email signs in to Microsoft or Google with OAuth.
Frequently asked questions
What is PKCE?
PKCE (Proof Key for Code Exchange) protects the sign-in code: your app creates a random code verifier, sends a hash of it (the code challenge) with the sign-in request, and then proves it holds the original verifier when exchanging the code for a token. It is required for public clients such as desktop and mobile apps.
Why do I need the offline_access scope?
Microsoft only returns a refresh token if you request offline_access. Without a refresh token, your app has to ask the user to sign in again when the access token expires (usually after about an hour). Google returns a refresh token when you request access_type=offline.
Can I use Microsoft Graph scopes for IMAP and SMTP?
No. IMAP, POP, and SMTP need Outlook scopes, such as https://outlook.office.com/IMAP.AccessAsUser.All. A token for Microsoft Graph is rejected by the email servers.