OAuth for third-party clients
Apps ask before they get in, and get only what you give them.
You choose the workspace, the addresses and what an app may do, for as long as you say. The same token opens the MCP server and the REST API.
In short
What are OAuth and PKCE?
OAuth lets an app act for you without your password: you approve it, and it gets a token whose scopes limit it. PKCE ties that exchange to the app that began it, so a stolen code is useless.
How it works
See the app and where access goes
Before anything is granted you see the name the app gave itself and the address your access would be sent to, then choose what it gets. An address it never registered cannot be approved.
Apps register themselves, then prove it
There is no key to paste: the discovery document tells a client where to register. One without a secret must present its PKCE verifier, or the code is refused.
Take access back from Connected apps
Account → Connected apps lists every app holding a token and what it may reach. Change its access there, or remove it and its next request is refused.
The discovery document
What a client reads before it registers.
{ "issuer": "https://api.nextmail.sh", "authorization_endpoint": "https://api.nextmail.sh/auth/mcp/authorize", "token_endpoint": "https://api.nextmail.sh/auth/mcp/token", "registration_endpoint": "https://api.nextmail.sh/auth/mcp/register", "scopes_supported": [ "openid", "profile", "email", "offline_access", "emails:send", "threads:read", "labels:write" ], "grant_types_supported": ["authorization_code", "refresh_token"], "token_endpoint_auth_methods_supported": [ "client_secret_basic", "client_secret_post", "none" ], "code_challenge_methods_supported": ["S256"]}What you get
In the product today
Self-registration flagged
An app that registered itself is marked on the consent screen and in Connected apps.
Your role is the ceiling
A connected app can never do more than your role allows.
One token, two surfaces
The same token opens the MCP server and the REST API, under the same limits.
Good practice
Getting the most out of it
- 01
Read the host line
The large line on the consent screen is where your access goes, so refuse a host you do not know.
- 02
Doubt self-registered services
Desktop AI clients normally register themselves, but a web service that did deserves a second look.
- 03
Give it the least it needs
Pick Read only, or just the permissions an app needs, and hold it to the addresses it works on. You can widen it later in Connected apps.
Questions
Asked often
Keep going
Works well with
Start
Your domain,
your mail.
Point a domain at Nextmail and read it in a mailbox built around it. The free plan covers one domain.
Google Workspace
Fastmail