I am not against hardening of security, but when manual review comes into play, you know there is a bias involved.

Here is the line that worries me:

If your public application uses scopes that permit access to certain user data, it must complete a verification process. If you see unverified app on the screen when testing your application, you must submit a verification request to remove it. Find out more about unverified apps and get answers to frequently asked questions about app verification in the Help Center.

This is the same story as google play apps requires and it will most probably only get worse the next years.

I don’t know if there’s a library that already does this, but it should be relatively simple to implement:

• Setup an OAuth lib and obtain a token
• Adapt the IMAP implementation to support the AUTHENTICATE command instead of the default LOGIN command.

Here’s an example imap implementation in PHP:

(Also see the Google Docs about the AUTHENTICATE command: OAuth 2.0 Mechanism  |  Gmail  |  Google for Developers)

Hi, you might want to give this a go… my new little lib

EDIT: I’ve tested with my own gmail account. With app password (the less secure thingy), I managed to access my emails with blop v0.1.4

Have you done that successfully with any other imap client?

If you are using gmail, using username/password for authentication is no longer possible:

Starting in January 2025, Google Workspace accounts will no longer support less secure apps, third-party apps or devices that ask you to sign in to your Google Account using only your username and password. For exact dates, visit Google Workspace Updates. To access apps, you must use OAuth. To prepare for this change, review the details in Transition from less secure apps to OAuth.