When the OAuth scope is set to anything other than [https://mail.google.com/], an error occurs with

[Tsutsumi]

Observer

Google OAuth Scope Settings Issue

Currently, we are developing an application that accesses Gmail, and using OAuth with the scope [https://mail.google.com/] for sending and receiving has been successful during development.

Subsequently, when attempting to transition to the production environment and applying to Google, we received a message instructing us to change to the following two restricted scopes:

https://www.googleapis.com/auth/gmail.readonly
https://www.googleapis.com/auth/gmail.send

After making this change, when attempting OAuth login in the application and trying to retrieve messages, an error "[NO [AUTHENTICATIONFAILED] Invalid credentials]" occurred, and we were unable to receive messages.

Reverting to the scope [https://mail.google.com/] resolves the issue, and we can receive messages without any problems.

However, we are unable to establish a connection with scopes other than [https://mail.google.com/]. What additional features or settings might be necessary for the application? We would appreciate guidance on resolving this issue.

[lawrencenelson · Accepted solution]

Hi @Tsutsumi,

Welcome to the Google Cloud Community!

Based on the Gmail API documentation, the scopes of https://www.googleapis.com/auth/gmail.addons.current.message.readonly and https://www.googleapis.com/auth/gmail.sendare classified as Sensitive scopes, while the https://mail.google.com/is a Restricted scope.

The issues you're encountering might stem from the usage type of these scopes, which could be affecting how your code interacts with the API.

You might also want to check these Stack Overflow threads to help you with your issue since I cannot check your code directly:

• Google OAuth2 API works for all scopes except the one I need, gmail.send
  
• Gmail Send request results in "insufficient authentication scopes" error
  

If the above options don't work, you can contact Google Cloud Support to further look into your case. Thank you!

[lawrencenelson · Accepted solution]

Hi @Tsutsumi,

Welcome to the Google Cloud Community!

Based on the Gmail API documentation, the scopes of https://www.googleapis.com/auth/gmail.addons.current.message.readonly and https://www.googleapis.com/auth/gmail.sendare classified as Sensitive scopes, while the https://mail.google.com/is a Restricted scope.

The issues you're encountering might stem from the usage type of these scopes, which could be affecting how your code interacts with the API.

You might also want to check these Stack Overflow threads to help you with your issue since I cannot check your code directly:

• Google OAuth2 API works for all scopes except the one I need, gmail.send
  
• Gmail Send request results in "insufficient authentication scopes" error
  

If the above options don't work, you can contact Google Cloud Support to further look into your case. Thank you!

[Tsutsumi · Accepted solution]

Thank you for the information. I tried various things based on the information you provided, but it doesn't work.

We are using the open-source library MailKit for development. There have been reports of cases where using MailKit with OAuth 2.0 and the scope "https://www.googleapis.com/auth/gmail.readonly" does not work properly.

According to the information found here: Stack Overflow Post,

https://stackoverflow.com/questions/60708820/what-is-the-correct-way-to-authenticate-using-gmail-oau...

"The scope you're using only works for Google's Web Request API, not for IMAP or POP3 access."

Checking this information, it states that the "readonly" scope works only for Google Web Request API. The question is whether it will work with the mentioned scopes in a Windows application. If it does work, could you please provide guidance on how to achieve this?

https://www.googleapis.com/auth/gmail.readonly
https://www.googleapis.com/auth/gmail.send