Automatic Conversion of Google mail accounts to OAuth 2.0 Authentication

Revision Information
  • Revision id: 245191
  • Created:
  • Creator: Michele Rodaro
  • Comment: delinkified the token entries (now in bold); formatted "unordered sub-list"
  • Reviewed: Yes
  • Reviewed:
  • Reviewed by: wsmwk
  • Is approved? Yes
  • Is current revision? No
  • Ready for localization: Yes
  • Readied for localization:
  • Readied for localization by: wsmwk
Revision Source
Revision Content

Thunderbird 91.8.0, released 5th April 2022, converts the authentication method of Gmail accounts to OAuth 2.0 to help users comply with Google's requirement of OAuth 2.0 for Gmail logins. These changes are required by Google.

We recommend updating to the latest version of Thunderbird for the latest security fixes and many other bug fixes and improvements. However, if you want to continue using an old version of Thunderbird below 91.8.0 at your own risk, you will have to change the authentication method to OAuth2 yourself. You can also use the following steps to double-check that your authentication method is actually set to OAuth2:


Do ≡ > Account Settings > YourAccount > Server Settings > Authentication method and ensure it is set to OAuth2.

Cookies and javascript must be enabled for OAuth 2.0 to work. If you have rejected cookies in Thunderbird, the OAuth process will fail because some cookies must be accepted to store data between page updates. You need to accept cookies at least temporarily using one of the methods described below.

How to avoid or correct an OAuth failure caused by rejected cookies

First, verify your general setting for cookies in Thunderbird:

  • Do ≡ > Preferences > Privacy & Security > Web Content.
  • Look at the checkbox Accept cookies from sites.

If Accept cookies from sites is not checked, do one of the following and then go through the OAuth login process again:

  • Create an exception to accept cookies from Google:
    • Click the nearby Exceptions… button to open the Exceptions - Cookies dialog.
    • In the Address of website input box, enter https://accounts.google.com.
    • Pick Allow, then Save Changes.
  • Alternatively, accept all cookies:
    • Set the checkmark for Accept cookies from sites.

After you have gone through the OAuth process, if you prefer, you can again reject cookies, because receiving and sending mail will work with cookies rejected. But rejecting all cookies or removing the exception has the disadvantage that when the OAuth token for Gmail access expires at some date in the future, the OAuth dialog will show up and fail again until you accept the required cookies.

For greater detail about cookies, see the article Privacy panel - Remote content and cookie settings in Thunderbird.

How to avoid or correct an OAuth failure caused by disabled javascript

  • Do ≡ > Preferences > General > Config Editor.
  • Paste in javascript.allow.mailnews.
  • If you see a line which contains false you must change it to true by double clicking the double-headed arrow to the right.

Check if the proper authentication tokens are being saved

  • Do ≡ > Settings > Privacy & Security > Passwords> Saved Passwords.
    • If account authentication was set to OAuth2 and OAuth login was successful you should see entries for each username (gmail account) of the form
oauth://accounts.googlecom (https://mail.googlecom/)
Note: The oauth entry is an OAuth2 authentication token, and not a password.
  • If account authentication was set to OAuth2 and OAuth login was not successful, check password entries for the username of the following form and delete them
imap://imap.gmailcom (imap://imap.gmailcom)
smtp://smtp.gmailcom (smtp://smtp.gmailcom)

If you're still having problems, you can ask a question in Thunderbird support.