---
title: "OAuth for third-party email apps"
description: "Apps connect to your Nextmail mailbox over OAuth with PKCE. You choose the workspace, the addresses and what each app may do, and can change or remove its access at any time."
url: "https://nextmail.sh/features/oauth"
---

[AI & agents](https://nextmail.sh/agents/features.md#approval)

# OAuth for third-party clients Apps ask before they get in, and get only what you give them.

You choose the workspace, the addresses and what an app may do, for as long as you say. The same token opens the MCP server and the REST API.

[Open mail](https://nextmail.sh/mail/inbox) [Get Started](https://nextmail.sh/signup.md)[Agent features](https://nextmail.sh/agents/features.md)

In short

## What are OAuth and PKCE?

OAuth lets an app act for you without your password: you approve it, and it gets a token whose scopes limit it. PKCE ties that exchange to the app that began it, so a stolen code is useless.

How it works

## See the app and where access goes

Before anything is granted you see the name the app gave itself and the address your access would be sent to, then choose what it gets. An address it never registered cannot be approved.

## Apps register themselves, then prove it

There is no key to paste: the discovery document tells a client where to register. One without a secret must present its PKCE verifier, or the code is refused.

## Take access back from Connected apps

Account → Connected apps lists every app holding a token and what it may reach. Change its access there, or remove it and its next request is refused.

## The discovery document

What a client reads before it registers.

Trimmed from the live document.

```
{  "issuer": "https://api.nextmail.sh",  "authorization_endpoint": "https://api.nextmail.sh/auth/mcp/authorize",  "token_endpoint": "https://api.nextmail.sh/auth/mcp/token",  "registration_endpoint": "https://api.nextmail.sh/auth/mcp/register",  "scopes_supported": [    "openid",    "profile",    "email",    "offline_access",    "emails:send",    "threads:read",    "labels:write"  ],  "grant_types_supported": ["authorization_code", "refresh_token"],  "token_endpoint_auth_methods_supported": [    "client_secret_basic",    "client_secret_post",    "none"  ],  "code_challenge_methods_supported": ["S256"]}
```

What you get

## In the product today

Self-registration flagged

An app that registered itself is marked on the consent screen and in Connected apps.

Your role is the ceiling

A connected app can never do more than your role allows.

One token, two surfaces

The same token opens the MCP server and the REST API, under the same limits.

Good practice

## Getting the most out of it

1. 01
   
   Read the host line
   
   The large line on the consent screen is where your access goes, so refuse a host you do not know.
2. 02
   
   Doubt self-registered services
   
   Desktop AI clients normally register themselves, but a web service that did deserves a second look.
3. 03
   
   Give it the least it needs
   
   Pick Read only, or just the permissions an app needs, and hold it to the addresses it works on. You can widen it later in Connected apps.

Questions

## Asked often

Keep going

## Works well with

MCP server

Point Claude, or any MCP client, at your mailbox.

REST API

A documented HTTP API with issuable, scopable, revocable keys.

Roles & permissions levels

A role says what somebody may do, and an address grant says where, unless the role reaches every address.

Start

## Your domain, your mail.

Point a domain at Nextmail and read it in a mailbox built around it. The free plan covers one domain.

[Open mail](https://nextmail.sh/mail/inbox) [Get Started](https://nextmail.sh/signup.md)[Read the reference](https://nextmail.sh/docs/knowledge/developers/oauth.md)