I have a Gmail account that uses POP to download emails from a GWS (Google Workspace) inbox, effectively another Gmail account.

enter image description here

In order for this to work, I had to turn on LSA (Less Secure App) for that GWS account.

Now Google is ending LSA, requiring OAuth going forward.

I see no facility in Gmail to to use OAuth for POP access.

Any ideas on how to deal with this or am I SOL? Has Google effectively crippled features between its own services?

PS. I prefer not use mail forwarding from the GWS inbox to my Gmail inbox. This has SPF drawbacks causing some legit emails to get labeled as spam.

  • Yes, it's possible. Try the article Setting up email reply (POP) Integration using OAuth and Google/Gmail. Let me know if it works for you and I'll put up an answer.
    – harrymc
    Commented Jan 21 at 16:05
  • @harrymc good article, but not sure if it helps with my issue. right now my gmail can access my gws inbox via pop using simple credentials to download the emails. soon google will be requiring oauth to access the gws inbox which means the current setup will fail. the article is a guide to create oauth credentials for gmail pop access. but how can gmail (in a client role, per the image in my post) access an external inbox via pop that requires oauth authentication?
    – rvh
    Commented Jan 22 at 20:38
  • Just try and see.
    – harrymc
    Commented Jan 22 at 20:42

1 Answer 1


I think the POP access can be handled the same way as someone who is using "Send mail as" for another Google address, where OAuth is also unavailable. I just helped a user with this (send mail as) today, because we force-turned off LSAs in our Google Workspace for Education domain and then (as expected) any in-use LSAs started to time out or claim "Authentication Failed. User name and password not accepted."

The solution for the above, that I believe should work for your POP case, too, is to

  1. Enable 2SV (2 Step Verification) in the Security section of your GWS account settings if not enabled already.
  2. With 2SV enabled, then you can create an "Application specific password" (ASP) (also in the Security section), name it "Gmail POP" or something,
  3. Then take the 16-character ASP that's generated and use that in the Password field for the POP configuration, instead of your actual account's password.

My understanding is that even though it's still straight-up username + password configured for the POP connection, it's more secure (or considered more secure by Google) because the password is just for that connection, is therefore of limited utility and access, and does not expose your actual password to your account.

I found this writeup helpful to explain all the steps used for the 'Send mail as' scenario, just adapt to your POP needs.

  1. Enable 2SV on your Google Workspace account: https://connect.ucsb.edu/training-support/connect-user-guides/google-workspace-email/enabling-googles-2-step-verification

  2. Set an app-specific password within your GWS account to enable the send-as from your gmail account: https://connect.ucsb.edu/training-support/connect-user-guides/google-workspace-email/app-passwords-to-send-mail-as

  • 1
    As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Mar 28 at 20:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .