Search code examples
ruby-on-railsoauthoauth-2.0gmail-imap

How to sustain access to Gmail API without storing sensitive user data?


What is the preferred method of accessing the Gmail API across sessions without user input? E.g. user logs in once, some fairly-non-sensitive ID is stored on my server, and I use that ID along with my app's secret/key to access user's mailbox...

I noticed that OAuth 1.0 is now deprecated by google (I'm assuming that OAuth 1.0 enables the aforementioned login mechanism), so what should we use? Does OAuth 2.0 + IMAP work with Gmail?

I'm using a Rails 3.2.6 backend.


Solution

  • Without storing the user's password, the only way for full GMail access is using IMAP/SMTP with OAuth 1. With OAuth 2 you currently can only access the Atom Inbox Feed.

    Though OAuth 1 was already marked deprecated by Google, it should be supported until April 2015.

    UPDATE:

    OAuth 2 authorization support for GMail IMAP/SMTP just recently arrived, so this is now the recommended way to go.