---
title: "OAuth for third-party email apps"
description: "Apps connect to your OpenEmail mailbox over OAuth with PKCE once you approve them, and lose access when you remove them. Per-app scope is not built yet."
url: "https://openemail.uk/features/oauth"
---

[Agents, API & MCP](https://openemail.uk/features.md#agents) Soon

# OAuth for third-party clients Apps ask before they get in, but cannot yet ask for less.

Consent and revocation are here. Scope is not: a token reaches your whole mailbox, not the part an app asked for.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[All features](https://openemail.uk/features.md)

In short

## What are OAuth and PKCE?

OAuth lets an app act for you without your password: you approve it, and it gets a token whose scopes limit it. PKCE ties that exchange to the app that began it, so a stolen code is useless.

How it works

## See the app and where access goes

Before anything is granted you see the name the app gave itself and the address your access would be sent to. An address it never registered cannot be approved.

## Apps register themselves, then prove it

There is no key to paste: the discovery document tells a client where to register. One without a secret must present its PKCE verifier, or the code is refused.

## Take access back from Connected apps

Account → Connected apps lists every app holding a token. Remove deletes its tokens, and its next request is refused.

## The discovery document

What a client reads before it registers.

Trimmed from the live document.

```
{  "issuer": "https://api.openemail.uk",  "authorization_endpoint": "https://api.openemail.uk/auth/mcp/authorize",  "token_endpoint": "https://api.openemail.uk/auth/mcp/token",  "registration_endpoint": "https://api.openemail.uk/auth/mcp/register",  "scopes_supported": ["openid", "profile", "email", "offline_access"],  "grant_types_supported": ["authorization_code", "refresh_token"],  "token_endpoint_auth_methods_supported": [    "client_secret_basic",    "client_secret_post",    "none"  ],  "code_challenge_methods_supported": ["S256"]}
```

What you get

## In the product today

Self-registration flagged

An app that registered itself is marked on the consent screen and in Connected apps.

Your role is the ceiling

A connected app can never do more than your role allows.

What MCP runs on

Every MCP request must carry one of these tokens.

Good practice

## Getting the most out of it

1. 01
   
   Read the host line
   
   The large line on the consent screen is where your access goes, so refuse a host you do not know.
2. 02
   
   Doubt self-registered services
   
   Desktop AI clients normally register themselves, but a web service that did deserves a second look.
3. 03
   
   Approve from a narrower role
   
   Until scope lands, an app reaches whatever the approving account can, so approve from one with less access.

Where it stands

## What is not built yet

Questions

## Asked often

Keep going

## Works well with

MCP server

Point Claude, or any MCP client, at your mailbox.

REST API

A documented HTTP API with issuable, scopable, revocable keys.

Roles & permissions levels

A role says what somebody may do; an address grant says what they may do it to.

Start

## Your domain, your mail.

Point a domain at OpenEmail and read it in a mailbox built around it. The free plan covers one domain.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[Read the reference](https://openemail.uk/docs/knowledge/agents/oauth.md)