Authorize Gmail mailbox access

Gmail connection uses a separate OAuth flow. App login only signs you in to MailGen. It does not replace consent to read or modify mail. Start with Google Cloud setup.

The backend OAuth bridge handles the mailbox callback at /v1/oauth/callback. It consumes one-time state before exchanging the code. It stores an encrypted temporary result. A fresh authenticated application session claims the result through /api/google-mailbox/complete and binds the verified mailbox.

The refresh grant stays outside the browser and public model catalog. A dedicated mounted key protects it with AES-256-GCM. The binding includes purpose, deployment, mailbox, credential source, and client identity. This key differs from the personal content key and Graph delta-link key.

Configure separate Web OAuth clients for app login and mailbox access. Use the exact callback for this deployment. Enable only the required APIs and scopes. Restart connection from the application after a failed or expired callback. Do not replay it manually.

See history and push for ongoing updates. Workspace delegation needs separate operator authority.