Gmail’s OAuth2 authentication is the most reliable way to send cold email at scale in 2025. No app passwords, no 2FA issues — just clean OAuth2 tokens that work. Here’s how to set it up.
Why OAuth2 Over App Passwords
App passwords are deprecated in many Google Workspace setups. OAuth2 gives you a refresh token that auto-renews — no manual rotation, no auth failures after 90 days.
Step 1: Create a Google Cloud Project
Go to console.cloud.google.com, create a new project, and enable the Gmail API under APIs & Services.
Step 2: Configure OAuth Consent Screen
Set up the consent screen with scopes: https://mail.google.com/ email profile. This covers both SMTP sending and IMAP reply detection.
Step 3: Create OAuth2 Credentials
Create a Web Application credential with your callback URL (e.g. https://yourapp.com/oauth/callback). Copy the Client ID and Client Secret.
Step 4: Get Refresh Token
Run the OAuth flow, authorize the account, and store the refresh token securely. This token is permanent (until revoked) and can generate new access tokens on demand.
Step 5: Send via SMTP with XOAUTH2
auth_str = base64.b64encode(f'user={email}\x01auth=Bearer {token}\x01\x01'.encode()).decode()
smtp.docmd('AUTH', f'XOAUTH2 {auth_str}')
I’ve implemented this in VisibleMail with per-account SOCKS5 proxy support for IP rotation. Contact me if you want help setting this up.