Does OAuth mean the app cannot read my email?

No. If you approve mail access, the app can read and send your mail. OAuth protects your password and lets you revoke access, but it does not limit what an approved mail app can do with your messages.

Why does the sign-in open in a browser?

So that you type your password into the provider's page, not into the app. The browser also shows the provider's real address, which helps you confirm you are not on a fake sign-in page.

Learn

What is OAuth? Signing in to email without a password

How a mail app gets access to your account through the provider's own sign-in page, without seeing your password.

The problem OAuth solves

For decades, mail apps signed in to IMAP and SMTP the simple way: you typed your password into the app, and it sent that password to the server every time it connected. That means every app you used had your actual password, two-factor sign-in could not protect those connections, and the only way to cut off one app was to change your password everywhere.

OAuth 2.0 (RFC 6749) changes that. You sign in on the provider's own page, and the app receives a token that grants limited access to your mail. The app never sees your password.

How the sign-in flow works

When you add an account, the app opens the provider's sign-in page in a browser window. You sign in there, with your password, passkey or two-factor code as usual. The provider then shows what the app is asking for, such as read, compose, send and permanently delete all your email, and you approve it.

The provider hands the app two tokens. The access token is short-lived (Google's expire after about an hour) and is what the app presents to the mail server. The refresh token lasts longer and lets the app get new access tokens without asking you to sign in again.

Mail servers accept the access token in place of a password through a SASL mechanism, either XOAUTH2 (used by Google and Microsoft) or OAUTHBEARER (RFC 7628). The IMAP command looks like this, with the base64 token shortened:

C: a1 AUTHENTICATE XOAUTH2 dXNlcj1hbGljZUBleGFtcGxlLmNvbQFhdXRoPUJlYXJlciB5YTI5...
S: a1 OK Success

Why providers push it

Microsoft turned off password sign-in (called basic authentication) for IMAP and POP in Exchange Online in 2022, so work and school Microsoft 365 accounts need OAuth. Google has also retired access for less secure apps that sign in with only a password. Both prefer OAuth because it works with two-factor sign-in, can be limited in scope, and can be revoked for one app at a time.

Some providers, including iCloud, Yahoo, AOL and Fastmail, offer app passwords for IMAP instead. An app password is a separate, random password created for one app. It is safer than your main password because you can revoke it on its own, but unlike OAuth it gives full access and does not expire.

Revoking access

Because each app has its own token, you can remove one app without touching anything else. Google lists connected apps under Security in your Google Account, and Microsoft lists them in your account's privacy or app permissions settings. Removing an app there invalidates its refresh token, and it loses access once its current access token expires.

Questions

Does OAuth mean the app cannot read my email?: No. If you approve mail access, the app can read and send your mail. OAuth protects your password and lets you revoke access, but it does not limit what an approved mail app can do with your messages.
Why does the sign-in open in a browser?: So that you type your password into the provider's page, not into the app. The browser also shows the provider's real address, which helps you confirm you are not on a fake sign-in page.

In Bloop.email

For Outlook accounts, Bloop.email uses Microsoft's own sign-in. Passwords and sign-in tokens are stored in your Mac's keychain, and the app connects straight to your provider with no Bloop server in between.

See the features