gmail, revisited

[ko567]

I've had gmail with Epyrus until a few days ago (with passwords), until it stopped working with messages about invalid user name or password.
The announcement of 14 March 2025 by Google
https://support.google.com/mail/answer/7126229?hl=en&ref_topic=7280141&sjid=5084722220548120599-NA
seems to imply that OAuth2 is now the only way to access gmail. (The 2-step verification method seems to have gone away?) Does anyone have Epyrus working with gmail and OAuth2?

I've read all the relevant threads in this forum, including the instructions from Claws mail https://forum.palemoon.org/viewtopic.php?f=73&t=30566&hilit=epyrus+gmail#p245695
for setting up OAuth2, but before I embark on this non-trivial task I wanted to see if there are any successes.

[Bilbo47]

gmail with Epyrus (with passwords) stopped ... invalid user name or password. Does anyone have Epyrus working with gmail and OAuth2?

Yes. From that link:

Gmail no longer supports third-party apps which require your Google username and password.

This is different from signing in to Gmail with "app passwords" (eligible only alongside two-step). I thought Ggl had stopped allowing login with Ggl-account password (not email-account password) several years ago. It makes sense, because I have Epyrus 2.1.3 working with several Gmail accounts. One main account got switched [shakes fist at Ggl] from app-password to OAuth by Ggl's policies, so I was motivated to make it work wth EP again. Another main account got set up with app-password a couple years ago, and is still working the same way now. (App passwords were updated less than 90 days ago.) I expect Ggl by policy to stop allowing app-passwords at some point; had thought that's what the announcement was going to say..

For the OAuth account in EP, custom pref items are

Code: Select all

oauth2.google.clientid     ... value ending with .apps.googleusercontent.com
oauth2.google.clientsecret ... value beginning with GOCSPX-

The other parts of the values are (I guess) unique to "my app" registered with Ggl; the process to set them up is certainly not "easy".

[Lucio Chiappetti]

As I said in another thread, I do not use Epyrus, but Alpine and/or fetchmail. I had set up quite as long time ago an "app password" (this involves setting up 2FA, but 2FA is not enough, one has to create this "app password" and use that from e-mail clients instead of one's normal personal password.
Since I use an IMAP connection only once per day to access Gsuite for cleanup (most e-mail is automatically forwarded to a non-G provider and fetched from there), I just verified that at present this is still working.

[gabrgv]

setting up OAuth2

When I was using Epyrus (before moving back to Mutt), I changed the clientid and clientsecret in Epyrus’ prefs to the ones provided by Thunderbird. It’s still working, as far as I know.

[back2themoon]

Haven't noticed any changes here. Epyrus works fine with app passwords (not your Google account password), which require 2FA to be enabled on each used account.

On your Google link, which doesn't look like an announcement but a regular support page, if you type "app password" on the top search bar, you'll find the usual info ("Sign in with app password" article).

The convoluted OAuth2 method works, but app passwords work best. I always had minor glitches with OAuth2 in Epyrus - none whatsoever with the "Normal password" authentication method.

[Moonchild]

No issues using an app password here too, for gmail.

[ko567]

Thanks very much to everyone who responded. This is very helpful information.
I will try the 2-step + password method first, it seems much simpler.
I can't read Google's mind (DeepMind?) but I wouldn't be surprised if they phased this out in the future in favor of OAuth2.
Still, everybody will deal with that when it happens.

[ko567]

I succeeded in getting Epyrus to work with gmail on my desktop. Now I'm trying to do the same with my laptop.
It seems that I need to go set up 2-step verification all over again on the laptop. Is that correct? Thanks.

[Moonchild]

No, 2-step verification is account-wide. Once you've set it up, you can use it. If you haven't disabled it again, it should still be active. if you did disable it, then yes you need to re-setup it.
What you probably need to do is generate a separate app password for your laptop (so just go through the app password generation step again).

[Lucio Chiappetti]

I use the same app password independently of machine or program

[ko567]

No, 2-step verification is account-wide. Once you've set it up, you can use it. If you haven't disabled it again, it should still be active. if you did disable it, then yes you need to re-setup it.
What you probably need to do is generate a separate app password for your laptop (so just go through the app password generation step again).

My situation seems to be more complicated . My laptop runs Windows 10, and I have a VirtualBox VM on it running FreeBSD. Epyrus, as well as PaleMoon, are on the FreeBSD VM.
I log into my Google account using Firefox (PaleMoon has a problem at the point of the 2nd screenshot). In the Security section I see that 2-step verification is on:

Google-security-on-laptop-1.png

Next, I go to Passkeys and Security keys:

Google-security-on-laptop-2.png

At this point I don't know what to do.

I use the same app password independently of machine or program

Should I try creating a new passkey? If I click on the arrow in the SM-G981U1 box, I see a number of "sessions", some probably corresponding to my desktop, but I don't know what to do with/about them.
If, at this point I create my gmail account in Epyrus, I get "Error 401: disabled_client".

[back2themoon]

Next, I go to Passkeys and Security keys

This is wrong. You need App passwords, not Passkeys and Security keys.

[ko567]

Yes, sorry. I finally did set up an app password, and changed my Google account password to it, per the instructions.

I must be still doing something else wrong, because when I try to set up my gmail account in Epyrus I still get the "disabled client" message. Giving up for now, at least I have my desktop working.

[Moonchild]

You have to make sure you use a normal password for authentication, NOT OAuth2. See attach (Note, I use POP3, but you should also be able to use IMAP, the settings would be the same)

[back2themoon]

I finally did set up an app password, and changed my Google account password to it, per the instructions.

Changed your Google account password to it? Where does this come from? Quick summary:

1. Enable 2FA on your Google account(s)
2. Create an app password in your Google account. You can give it a descriptive name like "Epyrus", although the name can be anything.
3. The app password is NOT your Google account password. They are different, and they must be different. In fact, if you change your Account password, your app password(s) is revoked and you have to create it again. See link below.
4. In Epyrus, you will enter the app password you created, NOT your Google Account password.

https://support.google.com/accounts/ans ... =en#zippy= (app passwords info)

edit: if your desktop and laptop use the same OS, you can just copy the entire profile and use it on both machines. No need for separate configurations, unless you use different accounts on each system.

[UCyborg]

How reliable is Epyrus for Gmail? Assuming using mailbox with over 20 GB of mails and set to store all mails locally, using IMAP for syncing.

I'm an Interlink (version 52.9.8194, the last one if I didn't miss any release) holdout (GUI aesthetics) and sometime in second half of the last year, it started happening every several weeks that I would launch the program and all mails would be lost. They literally disappear, folders are gone from the GUI and space on the disk occupied by emails is freed. Over a period of couple of minutes, I receive errors that say for each filter that I use that it will be disabled due to non-existent folders. Then I have to restart program for it to snap out of the weird state it's in, get all the folders and start redownloading all mails, which is a lenghty process. No errors in the console when mails disappear.

Could OAuth2 be a problem? I don't get any errors related to authentication. I've been using for good long while before this started happening.

I could switch, but if no one ever even heard about the problem... I did move the folder with mails to another, more spacious disk after the second occurrence of the problem, but it didn't change anything. There was still enough free space (25+ GB) on the first disk. Though who knows when it will re-occur (maybe I'm lucky and it won't), it's been OK since about mid January or so.

[back2themoon]

Could OAuth2 be a problem? I don't get any errors related to authentication.

I don't know if it's the cause of your problem, but it can definitively be a problem. I'd suggest switching to "Normal password" authentication.

Perhaps the OAuth2 implementation in Epyrus is older (I don't know if OAuth2 gets updates, or if the current Thunderbird OAuth2 variant is significantly different), perhaps it's something else. But I've mentioned this many times - it did cause issues for me (also in Interlink/FossaMail). Synchronisation issues.

[Moonchild]

How reliable is Epyrus for Gmail? Assuming using mailbox with over 20 GB of mails and set to store all mails locally, using IMAP for syncing.

I'm an Interlink (version 52.9.8194, the last one if I didn't miss any release) holdout (GUI aesthetics) and sometime in second half of the last year, it started happening every several weeks that I would launch the program and all mails would be lost. They literally disappear, folders are gone from the GUI and space on the disk occupied by emails is freed.

You have to realise that IMAP does not store all mails locally. It merely caches them locally, but IMAP is effectively a remote protocol. If there is an issue with your connectivity (for whatever reason! Not necessarily because of your authentication method) then syncing will fail and it may indeed remove your cached copies of mail.
If you want real permanent local storage you should use POP3, and set it up to leave all mail on the server as well if you want to keep accessing it from other devices/interfaces.

[Basilisk-Dev]

How reliable is Epyrus for Gmail? Assuming using mailbox with over 20 GB of mails and set to store all mails locally, using IMAP for syncing.

I have been using it since 2022 every single day for my work GMail account which has hundreds of thousands if not millions of emails. No issues here.

[Lucio Chiappetti]

How reliable is Epyrus for Gmail?

Possibly the question shall be reversed ... how reliable is Gmail for any truly standard-compliant MUA/IMAP client ?
We know the G* attitude (e.g.chrome) towards standards.

My personal preference is not to leave my personal e-mail (but spam, which they aren't so good at filtering) on a G* server. I always had all my e-mail stored on my work computer (static IP, contrary to home). recently with fetchmail. In the past sometimes while travelling I activated a private imap daemon to get remote access to old mail, but now I prefer to ssh to my own machine and use a line-mode MUA,