News for hackers. Stuff that matters.

A comment on Google will disable all but OAuth for IMAP, SMTP and POP starting Sept. 30. Parent comment

Re:Google will disable all but OAuth for IMAP, SMTP and POP ... by booi on Friday January 19, 2024 @06:49AM (#39054397)
and then have to reauthenticate it every 2 weeks because the refresh token seemingly expires for no reason...
[ Parent | on HN ]
Re:Google will disable all but OAuth for IMAP, SMTP and POP ... by nunez on Friday January 19, 2024 @08:42AM (#39055280)
The refresh token shouldn't expire.
[ Parent | on HN ]
Re:Google will disable all but OAuth for IMAP, SMTP and POP ... by gerwim on Friday January 19, 2024 @09:19AM (#39055726)
Maybe not for Google, but it's not part of the OAuth spec. It's perfectly valid for refresh tokens to expire.
[ Parent | on HN ]
Re:Google will disable all but OAuth for IMAP, SMTP and POP ... by nunez on Friday January 19, 2024 @03:26PM (#39060630)
Interesting. Many of the OAuth services I've used use non-expiring refresh tokens. Though I definitely agree; they should also have an expiry.
[ Parent | on HN ]
Re:Google will disable all but OAuth for IMAP, SMTP and POP ... by justinc8687 on Friday January 19, 2024 @07:03AM (#39054475)
If you set your app to "production", the refresh token works properly. Ignore the verification steps. It'll yell at you, but it'll work.
[ Parent | on HN ]
Re:Google will disable all but OAuth for IMAP, SMTP and POP ... by xmprt on Friday January 19, 2024 @11:51AM (#39057614)
How can you set an app to production without Google verification if you're not in a workspace. I'm guessing the answer is that there is no way.
[ Parent | on HN ]