40 lines
2.3 KiB
Markdown
40 lines
2.3 KiB
Markdown
# Discontinuing Native Gmail Login in Korax
|
||
|
||
**Date:** July 2026
|
||
|
||
## Summary
|
||
|
||
Korax will no longer support native "Sign in with Google" / Gmail OAuth login. Users who want to use a Gmail account with Korax will need to connect it via IMAP/SMTP with a Google App Password instead.
|
||
|
||
## Why
|
||
|
||
Korax's Gmail integration relies on the `gmail.modify` OAuth scope to read, send, and manage messages on the user's behalf. Google classifies `gmail.modify` as a **restricted scope**.
|
||
|
||
As of 2026, any app requesting a restricted scope must complete an annual **CASA (Cloud Application Security Assessment) at AL1** (formerly "Tier 2"). This assessment:
|
||
|
||
- Requires either a paid authorized-lab security scan (roughly $500–$4,500/year) or a paid commercial self-scan — the previous free, fully self-service scanning option has been discontinued by Google.
|
||
- Must be renewed every year, for as long as the app requests the scope.
|
||
- Takes 2–6 weeks to complete, with no guarantee of first-pass approval.
|
||
|
||
For an independent app like Korax, this recurring cost and process isn't sustainable to keep native Gmail OAuth alive.
|
||
|
||
## What this means for users
|
||
|
||
- **New setup:** Gmail accounts can still be connected to Korax, but via IMAP/SMTP using a [Google App Password](https://myaccount.google.com/apppasswords) instead of the "Sign in with Google" button.
|
||
- **Requirement:** App Passwords require Google 2-Step Verification (2FA) to be enabled on the account.
|
||
- **Existing users:** Korax is still in open beta with no existing users on native Gmail login, so there is no migration or cutover date to manage — this change applies from the start.
|
||
- **Other providers:** Non-Gmail accounts (any standard IMAP/SMTP provider) are unaffected.
|
||
|
||
## Alternatives considered
|
||
|
||
| Option | Why not chosen |
|
||
|---|---|
|
||
| Authorized lab CASA scan | Ongoing annual cost not viable for a one-time-purchase indie app |
|
||
| Commercial self-scan | Still a recurring paid cost; free self-scan path was removed by Google |
|
||
| Narrower OAuth scopes (`gmail.send`, `gmail.labels`) | Don't cover reading/decrypting mail content, which is core to Korax's PGP functionality |
|
||
| Drop Gmail support entirely | Not chosen — IMAP/App Password path preserves functionality without the compliance overhead |
|
||
|
||
## Questions
|
||
|
||
If you run into issues setting up Gmail via App Password, use the built-in bug reporting feature in the app.
|