Knowledge base
OAuth for third-party clients
Self-service client registration with PKCE, so an app can ask for access properly.
Not yet
Consent and revocation are here; scope is not, so a token reaches your whole mailbox rather than the part an app asked for.
Details
- Half shipped. Consent and revocation are here: a request is shown to you before it is granted, naming the app and the address your access would be sent to, and Account → Connected apps takes it back. What is missing is the scope: a token reaches your whole mailbox rather than the part of it an app asked for, so granting is still all-or-nothing.
- The mechanism underneath is real, and is what the MCP server authenticates with: a client registers itself, is issued an access token, and the discovery document is served at /.well-known/oauth-authorization-server.