OAuth for third-party clients
Apps ask before they get in, but cannot yet ask for less.
Consent and revocation are here. Scope is not: a token reaches your whole mailbox, not the part an app asked for.
In short
What are OAuth and PKCE?
OAuth lets an app act for you without your password: you approve it, and it gets a token whose scopes limit it. PKCE ties that exchange to the app that began it, so a stolen code is useless.
How it works
See the app and where access goes
Before anything is granted you see the name the app gave itself and the address your access would be sent to. An address it never registered cannot be approved.
Apps register themselves, then prove it
There is no key to paste: the discovery document tells a client where to register. One without a secret must present its PKCE verifier, or the code is refused.
Take access back from Connected apps
Account → Connected apps lists every app holding a token. Remove deletes its tokens, and its next request is refused.
The discovery document
What a client reads before it registers.
{ "issuer": "https://api.openemail.uk", "authorization_endpoint": "https://api.openemail.uk/auth/mcp/authorize", "token_endpoint": "https://api.openemail.uk/auth/mcp/token", "registration_endpoint": "https://api.openemail.uk/auth/mcp/register", "scopes_supported": ["openid", "profile", "email", "offline_access"], "grant_types_supported": ["authorization_code", "refresh_token"], "token_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "none" ], "code_challenge_methods_supported": ["S256"]}What you get
In the product today
Self-registration flagged
An app that registered itself is marked on the consent screen and in Connected apps.
Your role is the ceiling
A connected app can never do more than your role allows.
What MCP runs on
Every MCP request must carry one of these tokens.
Good practice
Getting the most out of it
- 01
Read the host line
The large line on the consent screen is where your access goes, so refuse a host you do not know.
- 02
Doubt self-registered services
Desktop AI clients normally register themselves, but a web service that did deserves a second look.
- 03
Approve from a narrower role
Until scope lands, an app reaches whatever the approving account can, so approve from one with less access.
Where it stands
What is not built yet
- Per-app scope
- A token reaches everything your role allows, not the part an app asked for.
- REST API access
- OAuth tokens open the MCP server only. The REST API takes a workspace key.
Questions
Asked often
Keep going
Works well with
Start
Your domain,
your mail.
Point a domain at OpenEmail and read it in a mailbox built around it. The free plan covers one domain.
