You can connect third-party email clients and apps to Gmail using the standard IMAP and POP protocols to receive mail and the SMTP protocol to send mail. All three servers support authentication and authorization using OAuth 2.0.
Authentication protocol
IMAP, POP, and SMTP use the standard Simple Authentication and Security Layer
(SASL), using built-in IMAP
AUTHENTICATE, POP AUTH, and SMTP AUTH commands to authenticate users. The
SASL XOAUTH2 format enables clients to provide OAuth 2.0 credentials for
authentication. The SASL XOAUTH2 protocol
documentation describes the SASL
XOAUTH2 format in detail, and OAuth 2.0 libraries and
samples are available that implement
the protocol.
Server addresses and ports
Use the following server addresses and ports to receive and send mail:
| Protocol | Direction | Server address | Port | Encryption |
|---|---|---|---|---|
| IMAP | Incoming (receive) | imap.gmail.com |
993 |
Implicit SSL/TLS |
| POP | Incoming (receive) | pop.gmail.com |
995 |
Implicit SSL/TLS |
| SMTP | Outgoing (send) | smtp.gmail.com |
465 |
Implicit SSL/TLS |
| SMTP | Outgoing (send) | smtp.gmail.com |
587 |
TLS (STARTTLS) |
Incoming connections to imap.gmail.com:993 and pop.gmail.com:995, as well as
outgoing connections to smtp.gmail.com:465, require implicit SSL/TLS. If your
SMTP client begins with plain text before issuing the STARTTLS command to
upgrade the connection, use smtp.gmail.com:587.
Use smtp.gmail.com to send mail from an email client or app on behalf of an
authenticated user. If you're a Google Workspace administrator routing
outgoing mail from an on-premises server, printer, scanner, or app (for example,
using smtp-relay.gmail.com), see Send email from a printer, scanner, or
app.
Session length limits
Gmail POP sessions last up to approximately 7 days. Gmail IMAP sessions last up to approximately 24 hours. If you authenticated the session using OAuth credentials, it lasts approximately the validity period of the access token used (usually 1 hour). A session in this context is one continuous Transmission Control Protocol (TCP) connection.
When the time elapses and the session expires, Gmail closes the connection with a message stating that the session expired. After that, the client can reconnect, authenticate again, and continue. If using OAuth 2.0, make sure that the access token used is valid. If you try to use an access token older than 1 hour, it might be invalid.
Sending and bandwidth limits
To keep systems healthy and accounts safe, Gmail enforces daily mail sending and bandwidth limits over a rolling 24-hour period. You can send up to 2,000 messages per day from a paid Google Workspace account and up to 500 messages per day from a Google Workspace trial account or personal Gmail account, with up to 100 recipients per message sent over SMTP by POP or IMAP clients. These limits are per user and are shared across all clients accessing the account. For complete details, see:
- Gmail sending limits in Google Workspace
- Limits for sending & getting mail (personal Gmail accounts)
- Gmail bandwidth limits
Libraries and samples
For convenience, developers often access mail using IMAP or POP and send mail using SMTP with existing IMAP and SMTP libraries. As long as these libraries support SASL, they should be compatible with the SASL XOAUTH2 format supported by Gmail.
In addition to the SASL XOAUTH2 protocol documentation, you might also want to read Using OAuth 2.0 to Access Google APIs for more information on implementing an OAuth 2.0 client.
The OAuth 2.0 libraries and samples page provides code samples in a variety of popular languages using the SASL XOAUTH2 format with either IMAP or SMTP.