Connect Gmail and Google Calendar

Your server can read your Gmail and your Google Calendar. Google has rules for how an app gets in. The way that keeps working depends on your account.

#Pick your way

A Google Workspace account is a work or school account. An admin runs it.

A sign-in app is a small setup you make in Google Cloud. It lets your server sign in to your Google account. Google calls it an OAuth app.

#Do not use test mode

A new sign-in app starts in test mode. Google calls it Testing. In Testing, every sign-in stops after 7 days. Your server would stop reading your mail each week. So never leave the app in Testing.

Out of Testing, a sign-in keeps working until you remove it. Google still ends it in two cases: nobody uses it for six months, or you change your Google password. Then you connect again.

#Mail with an app password

This is the way for a free Gmail account with no domain. An app password is a code of 16 characters. It lets one app read your mail. That app never sees your real password.

1. Turn on 2-Step Verification for your Google account.
2. Make an app password at myaccount.google.com/apppasswords.
3. In Recued, open Connections, then Mail. Choose Connect mailbox, then IMAP / SMTP.
4. Fill in the form:
   • IMAP Host: imap.gmail.com
   • IMAP Port: 993, with Use TLS on
   • Username: your Gmail address
   • Password: the app password
   • Folders: INBOX, [Gmail]/Sent Mail
5. To send mail too, set SMTP Host to smtp.gmail.com and SMTP Port to 465.

Did you change your Google password? That ends every app password. Make a new one. Some accounts do not get app passwords at all. You will not see them if you sign in only with security keys. You will not see them with Advanced Protection. Many work and school accounts do not have them either.

Google Calendar does not take app passwords. So this way works for mail only.

#A Workspace sign-in app

This is the way for a Google Workspace account. It covers mail and calendar.

1. Open the Google Cloud Console. Make a project, or pick one.
2. Go to APIs & Services, then Library. Turn on the Gmail API. Turn on the Google Calendar API too, if you want your calendar.
3. Open Google Auth Platform, then Audience. Choose Internal. There is nothing to publish. An Internal app has no Testing stage, so its sign-in does not stop after 7 days.
4. Go to Credentials. Choose Create credentials, then OAuth client ID, then Web application.
5. Under Authorized redirect URIs, add the callback URL that Recued shows. It is on the Gmail form under Connections.
6. Copy the Client ID and the Client secret into that form.

#A published sign-in app

This is the way for a free Gmail account when you own a web domain. It covers mail and calendar. Google only publishes the app when its details are complete.

Make the app like the Workspace one, with these changes:

1. Under Audience, choose External.
2. Open Branding. Fill in the app name, your support email, and the developer contact. Leave the logo empty.
3. Add a home page link and a privacy policy link. Both go on your own domain. Add a terms link too, if you have one.
4. Add your domain under Authorized domains. Prove you own it in Google Search Console.
5. Do not add recued.com. You cannot prove you own it, so Google will not publish the app.
6. Go to Audience and choose Publish app. The status becomes In production.

Your home page says what the app does. For example: it lets your own server read your own mail. Your privacy page says who uses it, and where the mail goes. For example: only you use it, and your mail stays on your own computer.

#Where a published app can connect

Google wants proof that you own every domain your app uses. That includes the domain a sign-in comes back to. So a published app connects from two places:

• Recued on your own domain, such as https://recued.your-domain.com. The sign-in comes back to your domain. List that domain under Authorized domains too, and prove you own it.
• The server's own address, http://127.0.0.1:7717/webclient.

It cannot connect from these:

• app.recued.com. Its sign-ins come back through recued.com.
• Your Pro address, https://<handle>.recued.net. Its sign-ins come back through recued.net.
• A LAN address. Its sign-ins go through recued.com too.

You cannot prove you own recued.com or recued.net. A Workspace app has no such limit. It is Internal, so there is nothing to publish.

#Open Recued where it can connect

To open Recued on your own domain, point the domain at your server first. Reachability shows how. Then open Settings, then Server, then Exposure. Under Exposure & serving, tick Public on the /webclient row. Go to /webclient on your domain, and connect there.

To use the server's own address, open Recued on the server itself at http://127.0.0.1:7717/webclient. Is this address new to your browser? Then pair it once, like a new device. Connect your Google account there. Does your server have no screen? Make a tunnel from your own computer:

ssh -L 7717:127.0.0.1:7717 you@your-server

Then open http://127.0.0.1:7717/webclient on your computer. You only connect once. After that, the account keeps working from app.recued.com too.

#Google's warning at sign-in

At sign-in, Google shows a warning: "Google hasn't verified this app". Choose Advanced. Then choose Go to your app's name (unsafe). Google says "unsafe" about every app it has not checked. This one is yours, and it only talks to your own server. On the next screen, allow the access it asks for. Up to 100 people can use an app like this.

#Calendar without Workspace or a domain

Google Calendar only lets apps in through a sign-in app. It does not take app passwords. So a free Gmail account with no domain cannot keep Google Calendar connected today. Mail still works, with an app password.

#Google's own MCP servers

Google Cloud also lists a Gmail MCP API and a Google Calendar MCP API. They use the same kind of sign-in app, so the same rules apply. They are still in an early preview. The Gmail one can write drafts, but it cannot send mail.

#Related

• Connections. How a saved connection works.
• Connect Outlook and Microsoft 365. The same choices for a Microsoft account.
• Use Recued on another device. The addresses your server answers on.