Nexus Mail Mail

← Back to Setup & mailbox · Privacy · Terms

Google OAuth verification & Gmail connect setup

This product uses Google OAuth so buyers click Sign in with Google and see Google’s consent screen (send mail, read mail for replies). Without GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET in mail_saas.env, no Google screen appears — configure credentials first, then restart the app.

1. Create a Google Cloud project

  1. Open Google Cloud Console.
  2. Create a project (e.g. nexus-mail-saas).
  3. Enable Gmail API and Google People API (or userinfo).
  1. APIs & Services → OAuth consent screen.
  2. User type: External (for public buyers).
  3. App name, support email, developer contact.
  4. Scopes to add: - https://www.googleapis.com/auth/gmail.send - https://www.googleapis.com/auth/gmail.readonly - openid - userinfo.email
  5. While unverified, add test users (their Google accounts can connect).

3. Create OAuth client

  1. Credentials → Create credentials → OAuth client ID.
  2. Application type: Web application.
  3. Authorized redirect URI (must match env):

https://YOUR_DOMAIN/api/mailbox/oauth/callback

Local example:

http://127.0.0.1:8090/api/mailbox/oauth/callback

  1. Copy Client ID and Client secret into mail_saas.env:
GOOGLE_CLIENT_ID=....apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=....
MAIL_SAAS_BASE_URL=https://YOUR_DOMAIN

4. Verification (production)

Gmail send/readonly are restricted scopes. Before public launch:

  1. Complete the OAuth verification questionnaire.
  2. Provide a privacy policy URL (use https://YOUR_DOMAIN/privacy from this app) and demo video of connect → send.
  3. Set MAIL_SAAS_CONTACT_EMAIL in mail_saas.env so the policy shows a real support address.
  4. Expect Google review time (days–weeks). Stay in Testing mode with allowlisted users until approved.
  5. Do not request unused scopes — keep the list minimal.

5. Security notes for reviewers

  • Refresh tokens are encrypted at rest (MAIL_SAAS_SECRET_KEY).
  • One mailbox per user; From address is forced to the connected account (sender lock).
  • One concurrent session per subscription seat (license lock).
  • Users can disconnect mailbox anytime.

6. Stripe Customer Portal

  1. Stripe Dashboard → Settings → Billing → Customer portal (enable cancel/update).
  2. Set STRIPE_SECRET_KEY, STRIPE_PRICE_ID (quantity 1), STRIPE_WEBHOOK_SECRET.
  3. Webhook endpoint: https://YOUR_DOMAIN/api/stripe/webhook Events: checkout.session.completed, customer.subscription.updated, customer.subscription.deleted.