Answers.Body: <p>This assumes you've already created a G Suite user and can successfully log into their e-mail manually.</p>
  <h3>On CiviCRM</h3>
  <ul>
  <li><a href="https://docs.civicrm.org/sysadmin/en/latest/setup/oauth/#enable-the-module" rel="nofollow noreferrer">Enable the OAuth extension</a>.</li>
  <li>Go to <strong>Administer menu » System Settings » OAuth</strong>.</li>
  <li>Click on <strong>Google Mail</strong>.</li>
  </ul>
  <h3>On Google.com</h3>
  <p>If the steps belong don't work, check the <a href="https://developers.google.com/identity/protocols/oauth2/web-server#prerequisites" rel="nofollow noreferrer">&quot;Prerequisites&quot; section of the &quot;Using OAuth 2.0 for Web Server Applications documentation</a> to see if anything has changed.</p>
  <ul>
  <li><a href="https://console.developers.google.com/apis/library" rel="nofollow noreferrer">Open the API Library</a> in the Google API Console.</li>
  <li>Select <strong>GMail API</strong> from the list of APIs.</li>
  <li>Click the <strong>Enable</strong> button.</li>
  <li>Visit the <a href="https://console.cloud.google.com/apis/credentials" rel="nofollow noreferrer">Credentials Overview</a> page.</li>
  <li>Click <strong>OAuth consent screen</strong> (may be labeled <strong>Configure Consent Screen</strong>).</li>
  <li>Select <strong>External</strong> <em>user type</em> and click <strong>Create</strong>. <strong>Note</strong>: Apps with external consent screens can require review from Google.  However, &quot;test mode&quot; allows up to 100 users.  Since you'll only have one user, you can keep your app in &quot;test mode&quot; indefinitely.
  <a href="https://i.sstatic.net/OpIf4.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/OpIf4.png" alt="enter image description here" /></a></li>
  <li>Fill in the following information - <strong>App Name</strong> (whatever you like), <strong>User support email</strong> and <strong>Developer Contact Information</strong> (your email address), and the <strong>Authorized domains</strong>.  This should be your site's domain.  Note that you want only the &quot;second level domain&quot;.  E.g. if your site is &quot;database.mysite.org&quot;, just enter &quot;mysite.org&quot;.</li>
  </ul>
  <p><a href="https://i.sstatic.net/8S3Ha.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/8S3Ha.png" alt="Google OAuth consent screen setup screenshot" /></a></p>
  <ul>
  <li>Press <strong>Save and Continue</strong>.</li>
  <li>On the <em>Scopes</em> screen, select <strong>Add or Remove Scopes</strong>.</li>
  <li>Add the <em>openid</em> and <em><a href="https://mail.google.com" rel="nofollow noreferrer">https://mail.google.com</a></em> scopes.
  <a href="https://i.sstatic.net/WZ25X.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/WZ25X.png" alt="Google API scopes screenshot" /></a></li>
  <li>Click <strong>Save and Continue</strong>.</li>
  <li>For <em>Test users</em>, click <strong>Add Users</strong> and add the email address(es) of the incoming email accounts you created.</li>
  <li>Click <strong>Save and Continue</strong>.
  <a href="https://i.sstatic.net/Z3Sn7.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Z3Sn7.png" alt="enter image description here" /></a></li>
  <li>Click <strong>Credentials</strong> in the left navigation menu.</li>
  <li>Click <strong>Create Credentials » OAuth Client ID</strong>.
  <a href="https://i.sstatic.net/zmTwT.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/zmTwT.png" alt="enter image description here" /></a></li>
  <li>Set <em>Application Type</em> to <strong>Web Application</strong>.</li>
  <li>Set <em>Name</em> to whatever you'd like.</li>
  <li>Click <strong>Add URI</strong> under <em>Authorized Redirect URIs</em>.  Add the Redirect URL from the CiviCRM OAuth screen (see &quot;On CiviCRM&quot; above).</li>
  <li>Click <strong>Create</strong>.</li>
  <li>You should get a screen that says <em>OAuth client created</em>, with a Client ID and Client Secret.
  <a href="https://i.sstatic.net/wZgsZ.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/wZgsZ.png" alt="enter image description here" /></a></li>
  <li>To retrieve these values at a later date, click the <strong>Edit</strong> icon next to the credentials you've just created.
  <a href="https://i.sstatic.net/NAP5t.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/NAP5t.png" alt="enter image description here" /></a></li>
  </ul>
  <h3>On CiviCRM</h3>
  <ul>
  <li>On The Google Mail OAuth screen you should already have open, paste in the Client ID and client secret you just retrieved from Google.</li>
  <li>Click <strong>Add</strong>.</li>
  <li>Go to CiviCRM's <strong>Administer menu » CiviMail » Mail Accounts</strong>.</li>
  <li><em>Add Mail Account</em> is no longer a button, but a select box.  Select <strong>Google Mail</strong>.</li>
  <li>You should see a Google login screen.  Log in with the incoming email account's credentials.</li>
  <li>CiviCRM should correctly autodetect all the correct values.  Review and press <strong>Save</strong>.  <strong>Note</strong> - if this is a bounce account, you still need to set the &quot;localpart&quot;.  E.g. if your bounce address is &quot;unsuccessful@example.org&quot;, your localpart is <code>unsuccessful+</code>.</li>
  <li>If you haven't already, don't forget to go to <strong>Administer menu » System Settings » Scheduled Jobs</strong> and enable the <em>Process Inbound Email</em> job (or <em>Fetch Bounces</em> if this is a bounce account).</li>
  </ul>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-02-14T20:22:04.430Z
Answers.Text: wow. super comprehensive answer. great work.
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-11-19T15:20:43.210Z
Answers.Text: Just been trying to do this and it's worked great up until the fourth step up from the bottom: 'Add Mail Account' is still a button for me. Has something changed since this was written, or have I missed something somewhere?
Answers.UserDisplayName: somnolentsurfer
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-05-26T22:22:09.717Z
Answers.Text: For others experiencing the bug somnolentsurfer describes - it's [a bug](https://lab.civicrm.org/dev/mail/-/issues/105) that's fixed in CiviCRM 5.44+.
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-09-30T19:11:47.353Z
Answers.Text: Amazing work Jon. Thank you so much! Worked great and the step by step directions were spot on.
Answers.UserDisplayName: guyiac
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-03-22T22:47:05.387Z
Answers.Text: Don't forget to enable IMAP in the Google account settings!
Answers.UserDisplayName: Aidan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-03-23T09:32:39.833Z
Answers.Text: Would be great to get this included in the docs: https://docs.civicrm.org/sysadmin/en/latest/setup/oauth/#gmail
Answers.UserDisplayName: Aidan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-04-06T21:27:45.443Z
Answers.Text: "Add Mail Account is no longer a button, but a select box. Select Google Mail."
  
  I'm on CiviCRM 5.59.3 and there is no select box, but a button "add mail account", like @somnolentsurfer also mentionned...
Answers.UserDisplayName: MarkDQ
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-04-06T21:31:26.267Z
Answers.Text: Also on 5.59.3, there is no "Administer menu » System Settings » OAuth", only "Authentication" (after installing OAuth2), which give no submenu with "Google Mail".
Answers.UserDisplayName: MarkDQ
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-04-07T14:37:38.857Z
Answers.Text: @MarkDQ The OAuth option appears at the top of the System Settings submenu, not the bottom.
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-04-08T08:08:01.827Z
Answers.Text: https://i.sstatic.net/Ixeee.png
  
  @jong there is no "OAuth" entry, not at the beginning of the submenu, nor elsewhere.
  
  Is it possible to get the OAuth form using cv?
  
  Or what is the uri behind this "OAuth" menu-item, maybe I can enter it manually?
Answers.UserDisplayName: MarkDQ
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-04-13T22:44:14.797Z
Answers.Text: I'd just use the internal option instead of external and stay in test mode.
Answers.UserDisplayName: Luke Stewart
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-02-14T20:09:38.497Z
Answers.LastActivityDate: 2023-04-07T14:37:10.020Z
Answers.LastEditDate: 2023-04-07T14:37:10.020Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Body: <p>Google has announced that traditional username/password logins to G Suite mail accounts <a href="https://workspaceupdates.googleblog.com/2019/12/less-secure-apps-oauth-google-username-password-incorrect.html" rel="noreferrer">will be disabled</a> and logins will require OAuth authentication in the future.  The <a href="https://docs.civicrm.org/sysadmin/en/latest/setup/oauth" rel="noreferrer">CiviCRM OAuth documentation</a> partly explains how to configure OAuth with CiviCRM, but says, &quot;After registering OAuth2 details with CiviCRM and Microsoft [sic], you can add an incoming email account.&quot; without explaining how.</p>
  <p>How do I register my OAuth2 details with Google?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-14T21:53:45.710Z
Comments.Text: has the timeline on this altered? https://workspaceupdates.googleblog.com/2020/03/less-secure-app-turn-off-suspended.html
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-02-14T22:32:03.190Z
Comments.Text: @petednz-fuzion I didn't know that!  That's good news.  I edited my question to avoid scaring people.
Comments.UserDisplayName: Jon G - Megaphone Tech
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2022-07-08T22:59:39.677Z
Comments.Text: Jon, your answer above worked great, except that for some reason it only works for a while, and then the access becomes lost. We've set this up for three separate instances of Civi and have had to re-do the steps three times now for all. Curious if you had any thoughts?
Comments.UserDisplayName: Kristin
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2022-08-16T19:54:53.047Z
Comments.Text: @Kristin I haven't had that issue so I'm not sure what might be causing it.
Comments.UserDisplayName: Jon G - Megaphone Tech
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-08-19T05:04:06.300Z
Comments.Text: >> Go to Administer menu » System Settings » OAuth. If you do not see the OAuth menu item after enabling the extension then try scaling your screen/browser up and down, chances are it will pop out at you.
Comments.UserDisplayName: DonH
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-08-19T16:46:40.950Z
Comments.Text: Welcome @DonH!
  
  Because of the Q&A nature of Stack Exchange (as opposed to a message board), this should be an edit to the other answer, since it is not itself an answer to the question.  You can alternatively post it as a comment on the original answer.  Either way, thank you for figuring this out and sharing with the community.
Comments.UserDisplayName: Jon G - Megaphone Tech
Tags: <email><google><oauth><inbound-email>
Title: How can I set up an incoming email (or bounce) account on GMail with OAuth?
ThreadText: # How can I set up an incoming email (or bounce) account on GMail with OAuth?
  
  (Asked by: username_0 on 2021-02-14)
  
  Google has announced that traditional username/password logins to G Suite mail accounts [will be disabled](https://workspaceupdates.googleblog.com/2019/12/less-secure-apps-oauth-google-username-password-incorrect.html) and logins will require OAuth authentication in the future. The [CiviCRM OAuth documentation](https://docs.civicrm.org/sysadmin/en/latest/setup/oauth) partly explains how to configure OAuth with CiviCRM, but says, "After registering OAuth2 details with CiviCRM and Microsoft [sic], you can add an incoming email account." without explaining how.
  
  How do I register my OAuth2 details with Google?
  
  **Tags:** email, google, oauth, inbound-email
  
  > **Comments:**
  > **username_1**: has the timeline on this altered? https://workspaceupdates.googleblog.com/2020/03/less-secure-app-turn-off-suspended.html  
  > **username_0**: @username_1 I didn't know that!  That's good news.  I edited my question to avoid scaring people.  
  > **username_2**: Jon, your answer above worked great, except that for some reason it only works for a while, and then the access becomes lost. We've set this up for three separate instances of Civi and have had to re-do the steps three times now for all. Curious if you had any thoughts?  
  > **username_0**: @username_2 I haven't had that issue so I'm not sure what might be causing it.  
  > **username_3**: >> Go to Administer menu » System Settings » OAuth. If you do not see the OAuth menu item after enabling the extension then try scaling your screen/browser up and down, chances are it will pop out at you.  
  > **username_0**: Welcome @username_3!  Because of the Q&A nature of Stack Exchange (as opposed to a message board), this should be an edit to the other answer, since it is not itself an answer to the question.  You can alternatively post it as a comment on the original answer.  Either way, thank you for figuring this out and sharing with the community.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2021-02-14. Score: 13
  
  This assumes you've already created a G Suite user and can successfully log into their e-mail manually.
  
  ### On CiviCRM
  
  * [Enable the OAuth extension](https://docs.civicrm.org/sysadmin/en/latest/setup/oauth/#enable-the-module).
  * Go to **Administer menu » System Settings » OAuth**.
  * Click on **Google Mail**.
  
  ### On Google.com
  
  If the steps belong don't work, check the ["Prerequisites" section of the "Using OAuth 2.0 for Web Server Applications documentation](https://developers.google.com/identity/protocols/oauth2/web-server#prerequisites) to see if anything has changed.
  
  * [Open the API Library](https://console.developers.google.com/apis/library) in the Google API Console.
  * Select **GMail API** from the list of APIs.
  * Click the **Enable** button.
  * Visit the [Credentials Overview](https://console.cloud.google.com/apis/credentials) page.
  * Click **OAuth consent screen** (may be labeled **Configure Consent Screen**).
  * Select **External** *user type* and click **Create**. **Note**: Apps with external consent screens can require review from Google. However, "test mode" allows up to 100 users. Since you'll only have one user, you can keep your app in "test mode" indefinitely.
    [![enter image description here](https://i.sstatic.net/OpIf4.png)](https://i.sstatic.net/OpIf4.png)
  * Fill in the following information - **App Name** (whatever you like), **User support email** and **Developer Contact Information** (your email address), and the **Authorized domains**. This should be your site's domain. Note that you want only the "second level domain". E.g. if your site is "database.mysite.org", just enter "mysite.org".
  
  [![Google OAuth consent screen setup screenshot](https://i.sstatic.net/8S3Ha.png)](https://i.sstatic.net/8S3Ha.png)
  
  * Press **Save and Continue**.
  * On the *Scopes* screen, select **Add or Remove Scopes**.
  * Add the *openid* and *<https://mail.google.com>* scopes.
    [![Google API scopes screenshot](https://i.sstatic.net/WZ25X.png)](https://i.sstatic.net/WZ25X.png)
  * Click **Save and Continue**.
  * For *Test users*, click **Add Users** and add the email address(es) of the incoming email accounts you created.
  * Click **Save and Continue**.
    [![enter image description here](https://i.sstatic.net/Z3Sn7.png)](https://i.sstatic.net/Z3Sn7.png)
  * Click **Credentials** in the left navigation menu.
  * Click **Create Credentials » OAuth Client ID**.
    [![enter image description here](https://i.sstatic.net/zmTwT.png)](https://i.sstatic.net/zmTwT.png)
  * Set *Application Type* to **Web Application**.
  * Set *Name* to whatever you'd like.
  * Click **Add URI** under *Authorized Redirect URIs*. Add the Redirect URL from the CiviCRM OAuth screen (see "On CiviCRM" above).
  * Click **Create**.
  * You should get a screen that says *OAuth client created*, with a Client ID and Client Secret.
    [![enter image description here](https://i.sstatic.net/wZgsZ.png)](https://i.sstatic.net/wZgsZ.png)
  * To retrieve these values at a later date, click the **Edit** icon next to the credentials you've just created.
    [![enter image description here](https://i.sstatic.net/NAP5t.png)](https://i.sstatic.net/NAP5t.png)
  
  ### On CiviCRM
  
  * On The Google Mail OAuth screen you should already have open, paste in the Client ID and client secret you just retrieved from Google.
  * Click **Add**.
  * Go to CiviCRM's **Administer menu » CiviMail » Mail Accounts**.
  * *Add Mail Account* is no longer a button, but a select box. Select **Google Mail**.
  * You should see a Google login screen. Log in with the incoming email account's credentials.
  * CiviCRM should correctly autodetect all the correct values. Review and press **Save**. **Note** - if this is a bounce account, you still need to set the "localpart". E.g. if your bounce address is "unsuccessful@example.org", your localpart is `unsuccessful+`.
  * If you haven't already, don't forget to go to **Administer menu » System Settings » Scheduled Jobs** and enable the *Process Inbound Email* job (or *Fetch Bounces* if this is a bounce account).
  
  > **Comments:**
  > **username_1**: wow. super comprehensive answer. great work.  
  > **username_4**: Just been trying to do this and it's worked great up until the fourth step up from the bottom: 'Add Mail Account' is still a button for me. Has something changed since this was written, or have I missed something somewhere?  
  > **username_0**: For others experiencing the bug username_4 describes - it's [a bug](https://lab.civicrm.org/dev/mail/-/issues/105) that's fixed in CiviCRM 5.44+.  
  > **username_5**: Amazing work Jon. Thank you so much! Worked great and the step by step directions were spot on.  
  > **username_6**: Don't forget to enable IMAP in the Google account settings!  
  > **username_6**: Would be great to get this included in the docs: https://docs.civicrm.org/sysadmin/en/latest/setup/oauth/#gmail  
  > **username_7**: "Add Mail Account is no longer a button, but a select box. Select Google Mail."  I'm on CiviCRM 5.59.3 and there is no select box, but a button "add mail account", like @username_4 also mentionned...  
  > **username_7**: Also on 5.59.3, there is no "Administer menu » System Settings » OAuth", only "Authentication" (after installing OAuth2), which give no submenu with "Google Mail".  
  > **username_0**: @username_7 The OAuth option appears at the top of the System Settings submenu, not the bottom.  
  > **username_7**: https://i.sstatic.net/Ixeee.png  @jong there is no "OAuth" entry, not at the beginning of the submenu, nor elsewhere.  Is it possible to get the OAuth form using cv?  Or what is the uri behind this "OAuth" menu-item, maybe I can enter it manually?  
  > **username_8**: I'd just use the internal option instead of external and stay in test mode.  
  
  ---
  
  