Gmail less secure apps: what to use instead

What should you check when Less secure app access is missing?

Start with the application’s sign-in options. Google recommends “Sign in with Google” when available. If the application doesn’t offer it, Google documents app passwords as an alternative for eligible accounts.

The distinction is the credential, not simply the mail protocol. An ordinary Google Account password, an app password, and an OAuth access token are different ways of authenticating. IMAP does not automatically mean ordinary-password access: Google’s XOAUTH2 documentation describes authenticating mail clients with OAuth 2.0 access tokens.

Before changing settings, identify whether you have a personal Gmail account or a managed Google Workspace account. Their IMAP controls differ:

These distinctions come from Google’s Gmail client guidance and Workspace’s POP and IMAP controls. A missing IMAP checkbox in a personal account is therefore a different issue from a missing app-password option.

For more on separating authentication from receiving and sending protocols, see IMAP, Graph and SMTP explained. If you’re reviewing connections beyond Gmail, use the 2026 email authentication checklist.

Should you use OAuth or a Gmail app password?

Prefer OAuth when the application offers “Sign in with Google.” Don’t choose an app password merely because an old setup guide shows a password field. First check what the application actually supports.

An app password is not OAuth, and creating one does not turn Less secure app access back on. Google provides a “Remove” action for revoking an app password. It also revokes app passwords when you change your Google Account password.

Mailera’s current Gmail connection uses the app-password route. It does not offer Gmail OAuth as a fallback. Check the Mailera Gmail connection requirements before creating a credential.

Use OAuth if the app supports it. If it supports only app passwords, check eligibility. If neither route is available, use a supported client or ask your Workspace administrator which connection is approved. Don’t disable account protections to make an incompatible application work.

How do you connect an eligible Gmail account to Mailera?

Use a mailbox you own or are authorized to connect. Mailera connects existing mailboxes; it does not create Gmail accounts or email addresses.

1. Check eligibility before entering credentials. Confirm that 2-Step Verification is enabled and that your Google Account offers app passwords. For Workspace, confirm administrator permission and IMAP access. An enabled 2-Step Verification setting alone does not guarantee that app passwords are available.
2. Create a dedicated app password. Follow Google’s app-password instructions to open the app-password controls for the intended account and create a password for this connection. Keep it private. If you are signed into multiple Google accounts, check which account you are managing before proceeding.
3. Open the single-mailbox flow. In Mailera, an Admin or Leader can open Mailboxes → Add mailbox → One mailbox. Enter the mailbox in Email address. Confirm Gmail detection, or select Gmail · Google Workspace under Or choose a provider, then select Continue.
4. Enter the app password. Review How to get an app password and What you'll need. Under Connection details, put the app password in Password, not your ordinary Google sign-in password. Set Display name and Mailbox group if needed.
5. Select Test & connect. Watch Incoming server sign-in and Outgoing server sign-in separately. Mailera tests the connection without sending an email. A successful sign-in test is not proof that a message has been delivered.
6. Check the connected mailbox and loaded messages. After connection, Mailera loads messages within its retention period, newest first. Inspect the mailbox’s status and latest sync, then open it to check that messages are appearing. If you need to verify sending, make that a separate test to another mailbox you own.

For a Workspace address on a custom domain, don’t assume provider detection has selected the intended service. Confirm the Gmail provider before continuing. Choosing another provider is not a way around Google’s account or administrator requirements.

If you also inspect the API, Gmail’s GET /mailboxes/{id}/status result is based on the latest sync. It is not a new, direct Google sign-in test. Read the status together with the sync time rather than treating it as a fresh credential check.

What common mistakes stop the connection?

When troubleshooting, record the failing stage and the account type. Don’t copy the app password into a support ticket. The useful details are whether the option exists, which sign-in stage failed, and whether credentials or organization policies recently changed.

Google’s missing-option explanations are listed in its app-password help. In particular, having 2-Step Verification configured only for security keys is one listed reason the option may be absent. Don’t assume every account with 2-Step Verification can generate app passwords.

For Workspace, Google’s restricted IMAP-client allowlist requires the specified clients to support OAuth. Ask the administrator whether that restriction applies. Mailera cannot restore the old access setting or override Google Account and Workspace restrictions; its Gmail app-password flow is unavailable when those requirements cannot be met.

Save as receive-only preserves a receiving connection when sending fails. It does not repair outgoing authentication or make sending available.

How should you protect and revoke an app password?

Treat an app password as a secret, not as a harmless setup code. Keep it out of screenshots, logs, repositories, support tickets, and chat messages. A dedicated credential also makes it easier to identify which connection you intend to remove.

To revoke one, open the app-password controls through Google’s instructions, identify the credential you no longer need, and use “Remove.” Revoke unused credentials. If a credential is exposed, remove it and create a replacement only if you still need the connection.

Changing your Google Account password also revokes app passwords. If you make that change, plan to replace the credential used by Mailera rather than repeatedly retrying the old one.

An app password should not be described as a narrowly scoped OAuth token. Review Mailera’s security information before connecting a work mailbox, and follow your organization’s credential-handling requirements.

If the mailbox will later feed an agent, keep that access separate from the Google credential. Use a least-privilege Mailera API key, require confirmation before sending, and treat incoming email as untrusted data, never as instructions. The guide to app passwords for agent mailboxes covers that next step.