How can I set up an incoming email account on GMail with OAuth?
This assumes you've already created a G Suite user and can successfully log into their e-mail manually.
On CiviCRM

Enable the OAuth extension.
Go to Administer menu » System Settings » OAuth.
Click on Google Mail.

On Google.com
You need to complete the &quot;Prerequisites&quot; section of the &quot;Using OAuth 2.0 for Web Server Applications documentation.

Open the API Library in the Google API Console.
Select GMail API from the list of APIs.
Click the Enable button.
Visit the Credentials Overview page.
Click OAuth consent screen.
Select External user type and click Create. Note: Apps with external consent screens can require review from Google.  However, &quot;test mode&quot; allows up to 100 users.  Since you'll only have one user, you can keep your app in &quot;test mode&quot; indefinitely.

Fill in the following information - App Name (whatever you like), User support email and Developer Contact Information (your email address), and the Authorized domains.  This should be your site's domain.  Note that you want only the &quot;second level domain&quot;.  E.g. if your site is &quot;database.mysite.org&quot;, just enter &quot;mysite.org&quot;.



Press Save and Continue.
On the Scopes screen, select Add or Remove Scopes.
Add the openid and https://mail.google.com scopes.

Click Save and Continue.
For Test users, click Add Users and add the email address(es) of the incoming email accounts you created.
Click Save and Continue.

Click Credentials in the left navigation menu.
Click Create Credentials » OAuth Client ID.

Set Application Type to Web Application.
Set Name to whatever you'd like.
Click *Add URI under Authorized Redirect URIs.  Add the Redirect URL from the CiviCRM OAuth screen (see &quot;On CiviCRM&quot; above).
Click Create.
You should get a screen that says OAuth client created, with a Client ID and Client Secret.

To retrieve these values at a later date, click the Edit icon next to the credentials you've just created.


On CiviCRM

On The Google Mail OAuth screen you should already have open, paste in the Client ID and client secret you just retrieved from Google.
DO NOT click &quot;Add&quot;. OAuth logins are only good for an hour, but they refresh automatically.  However, due to a quirk in Google's implementation, only the first login will refresh.  If you did by accident, remove all your login clients in Civi and in Google.
Go to CiviCRM's Administer menu » CiviMail » Mail Accounts.
Add Mail Account is no longer a button, but a select box.  Select Google Mail.
You should see a Google login screen.  Log in with the incoming email account's credentials.
CiviCRM should correctly autodetect all the correct values.  Review and press Save.
If you haven't already, don't forget to go to Administer menu » System Settings » Scheduled Jobs and enable the Process Inbound Email job.