How to Configure OAuth2 Authentication for Gmail in Thunderbird

Connecting Gmail to Thunderbird should use Google’s sign-in screen, not a password saved as a basic mail-client credential. Thunderbird calls this OAuth; it is based on OAuth 2.0, a sign-in method that lets Google verify you and issue Thunderbird an access token. The token lets Thunderbird sync mail without repeatedly sending your Google password.

This walkthrough follows Mozilla’s current instructions for Thunderbird ESR 153 and monthly Thunderbird 153 or newer, as documented on June 18, 2026. Older releases may show different menus or open Google sign-in in a Thunderbird tab instead of your system browser. If you can, update Thunderbird before you start. Google also says that personal Gmail accounts have IMAP enabled automatically as of January 2025, so there is no IMAP switch to turn on for those accounts.

For official version-specific details, see Mozilla’s Thunderbird and Gmail guide and Google’s instructions for adding Gmail to another email client.

Before you begin

Have your full Gmail address and Google Account password ready. You will enter the password only on a Google sign-in page, not in a Thunderbird “Normal password” authentication field. If your account uses two-step verification, also have the second factor available, such as a prompt on your phone or an authenticator code.

OAuth setup requires Thunderbird to open Google’s sign-in flow. Allow cookies in Thunderbird if you use restrictive privacy settings, and make sure your browser can reach Google Accounts. On a work or school Google Workspace account, an administrator may limit third-party app access; if Google blocks Thunderbird, ask the administrator whether the account’s policy permits the connection.

Add Gmail to Thunderbird with Google sign-in

1. Open the account setup screen. In current Thunderbird, open the application menu and choose Add Account, then Email. In other releases the route may appear as Account Settings or New Account. Choose the option to add an existing email account.
2. Enter your name and Gmail address. Use the name recipients should see and the complete Gmail address, including the domain. Select Continue. Thunderbird should detect Google’s server settings automatically. If it offers a Google account type or OAuth sign-in, keep that recommended path.
3. Continue in Google’s sign-in window. Thunderbird opens a Google-branded authorization flow, usually in your default system browser on current releases. Confirm that the page is on a Google sign-in domain, enter your Gmail address and password there, and complete any two-step verification prompt. Do not paste your regular Google password into a generic Thunderbird password prompt.
4. Review and grant access. Google will show the services Thunderbird wants to access. Review the requested permissions and continue only if they match the account features you want to use. Depending on your setup, Google may list email and possibly Calendar or Contacts. Approve the request to return to Thunderbird.
5. Wait for the initial sync. Thunderbird begins downloading message lists and, depending on synchronization settings, message content. A large mailbox can take time to populate. Keep Thunderbird open and connected while the first synchronization runs.

OAuth is the authentication step; IMAP and SMTP are the mail protocols Thunderbird uses to receive and send messages. Most users do not need to enter server details manually because Thunderbird configures Gmail automatically.

If automatic setup does not work

Open Account Settings, select the Gmail account, and check Server Settings for incoming mail. For the outgoing path, select Outgoing Server (SMTP) in the account settings and edit the server used by this Gmail account. Both incoming and outgoing authentication should use OAuth2. Setting only one side to OAuth2 can leave receiving or sending broken.

If you must check the connection details, Google’s recommended secure settings are:

Use your full Gmail address as the username for both. Prefer Thunderbird’s automatically detected Google settings when they are available; manual entries are useful for diagnosing a wrong host, port, encryption method, or authentication choice. Google’s help pages explain recommended Gmail IMAP behavior and connection details for third-party mail clients.

Fix common OAuth sign-in problems

Thunderbird keeps asking for a password

Check the authentication method for both the incoming server and its SMTP server. If either is set to Normal password, change it to OAuth2, save the settings, and restart Thunderbird. Remove stale saved Gmail credentials only if Thunderbird continues to reuse them; then initiate a fresh Google sign-in. Entering an app password into a connection configured for OAuth2 will not fix the mismatch.

The Google sign-in window does not open or finish

Update Thunderbird, temporarily check whether a browser extension or security tool is blocking the authorization page, and confirm that cookies are allowed for Google sign-in. If an account chooser appears, choose the same Gmail account you entered in Thunderbird. When Google returns an access-denied message for a managed account, the likely next step is an administrator policy check rather than repeated password attempts.

Mail receives but sending fails

Verify the outgoing SMTP server separately. It must point to Gmail’s SMTP host, use a supported encrypted port, and authenticate with OAuth2 and the full Gmail address. Check that the selected SMTP entry is actually assigned to the Gmail account; a different outgoing server can be selected in a multi-account Thunderbird profile.

The inbox looks incomplete or sync is slow

OAuth can succeed while folder synchronization is still in progress or limited by settings. Gmail labels appear as folders in Thunderbird, so a missing label may need to be subscribed to or included in synchronization. Google notes that syncing very large folders can slow clients; adjust folder synchronization if the first download is unusually large. These are mail-sync issues, not necessarily sign-in failures.

Check that setup is complete

Send a short test message from the Gmail account to an address you can check, then reply to it. Confirm that the outgoing message appears in Gmail’s Sent folder and that the reply arrives in Thunderbird. Also verify that messages marked read or moved in one place reflect the expected state in the other after syncing. If sending or receiving fails, revisit the corresponding incoming or outgoing OAuth2 setting before removing the account.

OAuth does not make a local computer immune to compromise: someone who can access your Thunderbird profile may be able to access the account’s saved authorization data. Protect your device with its normal operating-system security and lock screen. Google recommends “Sign in with Google” for supported mail clients; app passwords are an optional fallback for some accounts, but Google says they are unnecessary in most cases and are not the preferred setup for Thunderbird.