Connecting Gmail or Outlook with OAuth

If your mail is with Gmail or Outlook, OAuth is the better of the two routes. Rolehound never holds a password for your account, and you can take the access away from your provider's own pages whenever you want.

Connecting

Open Mailbox. Press Connect with Google or Connect with Microsoft. You are sent to the provider's own sign-in and consent screen, you approve it there, and you are returned to the Mailbox tab with the outcome. The connection is tested immediately, so the card shows Ok or an error rather than leaving you guessing.

The host and port are filled in for you, and the address on the account becomes the username. You are not asked to type anything.

What the consent screen asks for

Access to your mailbox over IMAP, and your email address. The address is asked for only so Rolehound knows which account to log in as.

Read the wording carefully, because it is broader than what Rolehound does. The permission that grants IMAP access is described by the provider in its widest terms, covering sending and deleting as well as reading. That is the permission IMAP requires; it is not a description of Rolehound's behaviour. The interface Rolehound uses to talk to your mailbox has no send method and no delete method, so there is no code in it that could take either action. What Rolehound reads sets the boundary out in full, and it is worth reading before you approve anything.

What is stored

A refresh token, encrypted before it is written, never shown back to you and never written to a log. No password, because there never was one. What that encryption does and does not protect it from is set out on the security page.

If the buttons do not get you there

Both buttons are always on the card, but OAuth only works if whoever runs this instance has registered an application with Google or Microsoft and configured its credentials. If they have not, the attempt will not complete. Use an app password instead — that route needs nothing from the operator.

Whether an inactive subscription also turns you around depends on how your instance is configured. On the configuration Rolehound ships with, it does not.

Disconnecting

Disconnect on the same card removes the stored connection and its token. To withdraw the grant at the provider as well, remove Rolehound from the third-party access list in your Google or Microsoft account settings.