OAuth is the most durable way to connect Gmail, Workspace, Outlook.com and Microsoft 365. Next Day Mail stores an encrypted refresh token and mints a fresh access token before every SMTP and IMAP session, so nothing breaks when the seller rotates the account password, and no 16-character secret sits in your database. On Microsoft it is the only option — basic auth is gone.

You register the client once. Every mailbox you own afterwards connects through the same client with a single sign-in, and the address is read from the OAuth response rather than typed by hand.

In the Google Cloud console: create a project, enable the Gmail API, then create Credentials → OAuth client ID → Web application. Add the redirect URI below exactly as shown — Google matches it character for character, including the scheme and any trailing path.

Authorised redirect URI:
<API_URL>/api/oauth/google/callback

.env:
GOOGLE_CLIENT_ID=...apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=...

API_URL must be the public HTTPS hostname of your API, not localhost, once you are off your own machine. Restart the API after editing .env — the client id is read at boot.

Next Day Mail requests https://mail.google.com/ (covers SMTP send and IMAP read), plus userinfo.email and openid so the address can be read back from the id_token. The mail scope is a restricted scope, which shapes how you configure the consent screen:

• Testing mode (recommended for personal use) — add every mailbox address you intend to connect as a test user. No verification needed. Refresh tokens issued in testing mode expire after 7 days on consumer Gmail accounts, so plan on reconnecting weekly, or publish.
• Internal — if all mailboxes live inside one Workspace tenant, set the app to Internal. No verification, no 7-day expiry. This is the cleanest setup.
• Published / External — works immediately with the "unverified app" interstitial (click Advanced → continue). Google only requires verification once you exceed the unverified user cap.

Next Day Mail always sends access_type=offline and prompt=consent, which is what forces Google to return a refresh token every time you connect.

Register an app in the Microsoft Entra admin center. Under Authentication add the redirect URI as a Web platform. Under Certificates & secrets create a client secret and copy the value (not the id). Under API permissions add the delegated Office 365 Exchange Online permissions SMTP.Send and IMAP.AccessAsUser.All, plus offline_access so tokens can refresh.

Redirect URI:
<API_URL>/api/oauth/microsoft/callback

.env:
MICROSOFT_CLIENT_ID=...
MICROSOFT_CLIENT_SECRET=...        # the secret VALUE
MICROSOFT_TENANT=common            # 'consumers' for outlook.com/hotmail only
                                   # your tenant GUID for a single 365 tenant

Supported account types must include personal Microsoft accounts if you are connecting bought Outlook.com/Hotmail mailboxes. Leaving a single-tenant registration on common fails every consent with AADSTS50194 — set the tenant GUID instead.

On a 365 tenant, OAuth does not bypass the mailbox-level SMTP AUTH setting. An admin has to leave Authenticated SMTP enabled for each mailbox in the Exchange admin center (Active users → mailbox → Mail → Manage email apps), and the tenant-wide SmtpClientAuthenticationDisabled flag must be false. Consumer Outlook.com accounts have no such switch — OAuth alone is enough.

In Accounts, use + Gmail / Outlook (OAuth). Before you click through to the provider, set whether the mailbox is a pool (seed) account, whether the seed is fresh or aged, and the registered country — that metadata travels through the OAuth state and is applied when the mailbox is created, so a bought seed enters the conditioning pipeline pinned to the right region from its very first login.

Sign in as the mailbox owner in the popup, through the same proxy country you are pinning it to. Next Day Mail reads the address from the response, encrypts the refresh token and immediately schedules a DNS and transport check.

• redirect_uri_mismatch — API_URL differs from the URI registered with the provider. They must match exactly, including https and no trailing slash.
• no refresh token — the consent was a repeat approval. Remove the app from the account's third-party access list and reconnect; Next Day Mail forces re-consent, but a cached grant on the provider side can still suppress it.
• invalid_grant after a week on a Google account — the consent screen is still in Testing mode. Publish it or move the mailboxes into a Workspace tenant with an Internal app.
• 535 5.7.3 Authentication unsuccessful on Microsoft — SMTP AUTH is disabled for that mailbox or the tenant. Fix it in the Exchange admin center.

The doctor in Accounts reproduces each of these with the exact provider error text.