2.3 KiB
Discontinuing Native Gmail Login in Korax
Date: July 2026
Summary
Korax will no longer support native "Sign in with Google" / Gmail OAuth login. Users who want to use a Gmail account with Korax will need to connect it via IMAP/SMTP with a Google App Password instead.
Why
Korax's Gmail integration relies on the gmail.modify OAuth scope to read, send, and manage messages on the user's behalf. Google classifies gmail.modify as a restricted scope.
As of 2026, any app requesting a restricted scope must complete an annual CASA (Cloud Application Security Assessment) at AL1 (formerly "Tier 2"). This assessment:
- Requires either a paid authorized-lab security scan (roughly $500–$4,500/year) or a paid commercial self-scan — the previous free, fully self-service scanning option has been discontinued by Google.
- Must be renewed every year, for as long as the app requests the scope.
- Takes 2–6 weeks to complete, with no guarantee of first-pass approval.
For an independent app like Korax, this recurring cost and process isn't sustainable to keep native Gmail OAuth alive.
What this means for users
- New setup: Gmail accounts can still be connected to Korax, but via IMAP/SMTP using a Google App Password instead of the "Sign in with Google" button.
- Requirement: App Passwords require Google 2-Step Verification (2FA) to be enabled on the account.
- Existing users: Korax is still in open beta with no existing users on native Gmail login, so there is no migration or cutover date to manage — this change applies from the start.
- Other providers: Non-Gmail accounts (any standard IMAP/SMTP provider) are unaffected.
Alternatives considered
| Option | Why not chosen |
|---|---|
| Authorized lab CASA scan | Ongoing annual cost not viable for a one-time-purchase indie app |
| Commercial self-scan | Still a recurring paid cost; free self-scan path was removed by Google |
Narrower OAuth scopes (gmail.send, gmail.labels) |
Don't cover reading/decrypting mail content, which is core to Korax's PGP functionality |
| Drop Gmail support entirely | Not chosen — IMAP/App Password path preserves functionality without the compliance overhead |
Questions
If you run into issues setting up Gmail via App Password, use the built-in bug reporting feature in the app.