Authorizing Your App with Gmail

All requests to the Gmail API must be authorized by an authenticated user. Gmail uses the OAuth 2.0 protocol for authenticating a Google account and authorizing access to user data. You can also use Google+ Sign-in to provide a "sign-in with Google" authentication method for your app.

Why use Google for authentication?

Providing OAuth 2.0 user authentication directly or using Google+ Sign-in reduces your development overhead. It also provides a trusted and secure login system that's familiar to users, consistent across devices, and removes the burden of users having to remember another username and password.

Publicly available applications with access to certain user data must pass review. If you see an access error for your app, submit a request using our OAuth Developer Verification form.

For personal-use apps and those you are testing, join the Google group Risky Access Permissions By Unreviewed Apps, which allows you to approve data access with your personal and testing accounts. Members of this group can grant unverified apps access to their data. See the Google API Services User Data Policy for more information.

How authorization works

At a high level, all apps follow the same basic authorization pattern:

1. During development, register the application in the Google API Console.
2. When the app launches, request that the user grant access to data in their Google account.
3. If the user consents, your application requests and receives credentials to access the Gmail API.
4. Refresh the credentials (if necessary).

Get started

To get started, see Implementing Server-side Authorization.