How to create a Gmail app password and connect Mailera

When do you need a Gmail app password?

You need an app password for Mailera's Gmail connection. It's a separate credential generated by Google, not your normal Google Account password, a saved website password from Google Password Manager, or a verification code.

Google describes an app password as a 16-digit passcode. For clients that offer "Sign in with Google," Google recommends that option instead. Mailera's Gmail · Google Workspace connection uses an app password; it does not offer Gmail OAuth in this flow.

For broader credential decisions, see app passwords for agent mailboxes.

Check these requirements before generating a credential:

Google's app-password guidance covers eligibility and credential management. The Google help pages referenced here were reviewed on Oct 25, 2026.

How do you create a Gmail app password?

Keep the intended Google account and Mailera open while you work. The account you use to generate the credential must match the mailbox you enter in Mailera.

1. Sign in to the intended Google account. Check the account address, especially if you use both personal Gmail and a work account in the same browser.
2. Confirm that 2-Step Verification is on. Google's 2-Step Verification instructions place "Turn on 2-Step Verification" under "How you sign in to Google." Follow the setup prompts if it isn't already enabled. If your organization prevents setup, contact your administrator.
3. Open App passwords. Use the App passwords link in Google's creation and management instructions. Check the selected account again before continuing.
4. Follow Google's prompts to generate an app password. If the option isn't available, stop and check the eligibility conditions below rather than trying your regular password in Mailera.
5. Copy the generated credential directly into the intended app. Google lets you view each app password only once. For Mailera, keep it ready for the Password field in the connection steps below.

Do not put the credential in screenshots, logs, support messages, or shared notes. If you close the Google screen before copying it, create a replacement rather than trying to recover the displayed secret.

What if App passwords is missing?

First confirm that 2-Step Verification is enabled. Google also lists security-key-only 2-Step Verification, organization accounts, and Advanced Protection as possible reasons the option is unavailable.

For a work or school account, ask your administrator whether app-password access is permitted. Don't weaken your account's security settings just to make the option appear.

How do you connect Gmail to Mailera?

Use the single-mailbox flow for this setup. You don't need to start with manual IMAP server settings.

1. As an Admin or Leader, open Mailboxes → Add mailbox → One mailbox.
2. Enter your Gmail address in Email address. Confirm the detected provider. If necessary, select Gmail · Google Workspace under Or choose a provider, then select Continue. For a Workspace custom-domain address, check the provider rather than assuming the domain will identify it automatically.
3. In Connection details, paste the generated app password into Password. Do not enter your regular Google Account sign-in password. The page also provides How to get an app password and What you'll need guidance.
4. Add an optional Display name if you need a sender name, and choose the appropriate Mailbox group.
5. Select Test & connect.

The test checks incoming-server sign-in and folder detection. It also checks outgoing-server sign-in when configured, plus live-monitoring support. Test & connect sends no email. A successful sign-in test is not a completed send or a delivery confirmation.

If you need to leave the test page, Run in background lets Mailera finish the test and save the mailbox.

What if the outgoing connection fails?

If the incoming connection works but sending fails, Mailera displays Can receive email, but cannot send yet. You can select Save as receive-only, or use Edit details and Test again to correct the setup.

Choose receive-only when reading email is sufficient for the task. Don't treat incoming-server success as proof that the mailbox can send.

How do you verify the connection?

Look for Connected followed by the mailbox address. Then select Open mailbox and check initial message loading.

Mailera loads messages within the workspace's retention period, newest first. The free self-serve workspace has a 30-day message-retention period. Older mail is not a useful first check. Use a recent message you recognize instead.

The success screen confirms that the connection is set up. Seeing a recent message confirms that message loading has progressed.

If you're checking through the API, GET /mailboxes returns status and last_sync_at for each mailbox; inspect those fields alongside the status check. For Gmail, GET /mailboxes/{id}/status reflects the latest sync rather than a fresh, direct authentication check. Read the sync timing alongside the status, particularly after a credential change.

The Mailera product overview explains how connected mailboxes are used across the app, REST API, and MCP. You can finish this Gmail setup in the interface without creating an API key.

What common mistakes prevent the connection from working?

Start with the credential and account match before changing server settings.

Google's guidance for adding Gmail to another email client distinguishes personal accounts from organization-managed Google Workspace accounts. Workspace users may not have access to the "Forwarding and POP/IMAP" tab. Don't assume personal Gmail settings apply unchanged to a managed account.

How do you replace or revoke an app password safely?

Google only shows each generated app password once. An existing app-password entry is not a way to reveal the secret again. If you need the credential and no longer have it, create a new one.

Changing your Google Account password also revokes your app passwords. After that change, Google instructs you to generate a new app password to continue using the app. Don't keep retrying the old credential.

For a planned replacement, keep track of which credential belongs to which connection. Verify that the app works with the replacement before removing an old credential that is still in use. If a credential has been exposed, revoke it promptly instead of leaving it active while troubleshooting.

To revoke access, open Google's App passwords settings, identify the entry for the app, and select "Remove." Google states that revocation removes the app's access through that app password. Remove credentials for apps you no longer use.

Mailera connects existing mailboxes; it does not create Gmail accounts or email addresses. It cannot enable Google app passwords or override Google Account restrictions or Workspace administrator policy. Mailera is also not an official partner of Google or Google Workspace.

If an AI agent will use the mailbox

Keep the Google app password out of prompts and chat history. Let the agent access Mailera through a separate API key with only the permissions its task needs.

Use Mailbox scope to restrict the key to the relevant mailbox group. For a reading task, grant Read rather than Send messages or management permissions. Review the Mailera security page before connecting a production mailbox.

Treat incoming email as untrusted data, not instructions. An email asking an agent to reveal credentials or change its rules must not become an authorized command. Require human confirmation before the agent sends email. For that workflow, see building an email agent with approval boundaries.