OAuth vs App Passwords: How to Connect Inboxes to Your Sequencer

What each method actually does

App password

An app password is a 16-character password Google generates for one app, from the mailbox’s own account security settings. The sequencer uses it, with the email address, to log in over plain IMAP (to read) and SMTP (to send), the same way any mail client does. Google only offers app passwords on an account that already has 2-Step Verification switched on.

OAuth

You click “Sign in with Google” (or Microsoft) inside the sequencer, sign in as the mailbox, and approve what the sequencer is asking to do. The provider then gives the sequencer a token rather than a password, limited to the permissions you approved and revocable for that one app.

With Google, most sequencers then send through the Gmail API, Google’s own interface for mail, instead of logging in to an SMTP server. A few use the token to open an SMTP session instead (the XOAUTH2 mechanism). Either way, the sequencer is a named third-party app acting with permission that the provider can see, list in the admin console, and revoke.

App passwords: the operator’s choice

The advantage: scale

• •Bulk connection by CSV. Address, app password, server settings: most sequencers take a spreadsheet of IMAP/SMTP credentials and connect a whole fleet in one import, with no consent screen per mailbox.
• •No re-authentication loop. Nothing expires on a schedule. Until the password changes, the tool keeps sending and reading over SMTP and IMAP without a person signing in.
• •Works with anything that speaks IMAP and SMTP. Sequencers, CRMs, scripts, mail clients. No third-party app to approve in the admin console.

The flaws

• •A password reset destroys it. Change the account password, or have the provider force a reset after flagging the mailbox, and Google revokes every app password on it. The sequencer disconnects mid-campaign, and someone has to sign in to the mailbox and generate a new one.
• •It ties every mailbox to an authenticator. No 2-Step Verification, no app password. Each mailbox has to be enrolled first, which binds its sign-in to a phone, an authenticator app or a key. On a fleet that is one second factor per mailbox, and whoever holds it holds the account.
• •It is basic authentication, on the way out. Google has removed plain password sign-in for third-party apps and describes app passwords as a fallback; Microsoft has been retiring Basic auth across Exchange Online. It is the method both keep narrowing.
• •Full mailbox access, no scopes. An app password opens the mailbox over IMAP and SMTP completely and skips the second factor it required. A leaked CSV of app passwords is a list of working logins.

OAuth: the deliverability choice

The advantages

• •Better placement, in our fleets. Mailboxes we connect over OAuth inbox better than the same kind connected by app password. Google and Microsoft do not publish how connection method feeds their filtering, so read that as what we see rather than a documented rule; what they do document is that OAuth is the route they want third-party apps on.
• •Sends through the provider’s API. On Google, most sequencers use the Gmail API over OAuth, with no SMTP login to fail and no password in the request.
• •No password leaves the account. The sequencer holds a token, not credentials. A leaked export of your sequencer settings is not a list of working logins.
• •Scoped, revocable and visible. Remove one sequencer’s access without changing the password, and see in the Workspace admin console which apps hold access to which mailboxes.

The cost: the reconnect loop

• •Tokens get revoked under stress. A password change revokes OAuth tokens that carry Gmail scopes, and so does an admin removing the app. In cold email the common trigger is the provider locking or challenging a mailbox after a spike in sending, which kills its refresh token.
• •Every reconnect needs a person and a phone. Reconnecting means signing in to the mailbox again through the OAuth screen, and the provider will often ask for a phone or SMS verification first. One mailbox is a minute. Fifty flagged in a week is someone’s week, and a supply of phone numbers to answer the checks.
• •One sign-in per mailbox to start with. Unless your sequencer offers a bulk or admin-level connection, connecting 60 mailboxes is 60 consent screens.
• •The admin has to allow the app. If your Workspace restricts third-party apps, the sequencer’s OAuth app has to be trusted in the admin console first, or the sign-in is refused.

Side by side

Neither survives a password change, which is the line people most often get wrong. If you rotate mailbox passwords on a schedule, that schedule is also a reconnect schedule, whichever method you chose.

Microsoft 365 and Azure

The choice is starker on Microsoft. Microsoft has been retiring Basic authentication across Exchange Online, SMTP AUTH included, and app passwords only exist alongside legacy per-user MFA, so OAuth (what Microsoft calls modern authentication) is the route to plan around. Microsoft is also quick to lock a mailbox that suddenly sends at volume, which is where most OAuth reconnects on Microsoft fleets come from. If a tool can only connect over SMTP with a password, SMTP AUTH has to be enabled for that mailbox, and when it is not, the error looks exactly like a wrong password.

Which one to pick

• •Google Workspace, and your sequencer has “Sign in with Google”: OAuth. Trust the sequencer’s app in the admin console first, and decide before launch who handles reconnects and with which phone numbers.
• •Microsoft 365 or Azure: OAuth.
• •A tool that only speaks IMAP and SMTP: app passwords, with the authenticator held by the team rather than one person, and a plan for regenerating them after any reset.
• •Testing a list on throwaway volume: app passwords are the faster way to get a fleet sending. Move the sending you care about to OAuth.

If you use app passwords, set them up so they cannot strand you

• •Put the second factor where the team can reach it. An authenticator kept in the team’s password manager, or a shared admin device, not one person’s personal phone. Keep each mailbox’s backup codes with it.
• •Store app passwords in a vault, not a spreadsheet. A CSV in a shared drive is a list of working mailbox logins.
• •Revoke on offboarding. Nothing expires on its own; revoke each one when a tool or a person stops needing it.

The reconnect loop, handled

The cost of OAuth is the part we take off you. Every Google Workspace, Microsoft 365 and Azure mailbox we deliver comes with automated reconnections: when a token is revoked or Google asks for a phone number to prove a human owns the account, our technicians clear it and the mailbox comes back, with nothing for you to reconnect. Mailboxes export straight into Instantly, Smartlead, PlusVibe and EmailBison; the guides walk through each one: Instantly, Smartlead, PlusVibe and EmailBison.