diff --git a/changelog.mdx b/changelog.mdx index a57a474..1632d93 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -4,6 +4,21 @@ description: "New features, improvements, and fixes across the Sendmux platform. rss: true --- + + ## Connected account authorisation + +Google and Microsoft connected accounts now request sending-only mailbox access. Sendmux no longer asks to read, change, or delete mailbox content, and the sender address always matches the mailbox that completed authorisation. + +Large account pools can now complete each mailbox authorisation without a shared attempt limit interrupting the batch. Imported accounts that need a connection show **Authorise** directly from their pending row. + +See [Connect Google and Microsoft accounts](/guides/connect-google-microsoft-accounts) for administrator preparation, permissions, and large account pools. + + ## Navigation freshness + +Your balance, notification count, and inbox unread count now refresh after you return to an inactive browser tab. The inbox count stays current without requiring you to open **Inboxes** first. + + + ## Bug fixes diff --git a/docs.json b/docs.json index 949205d..8f96a62 100644 --- a/docs.json +++ b/docs.json @@ -95,6 +95,7 @@ "guides/sending-via-http", "guides/sending-via-smtp", "guides/sending-accounts", + "guides/connect-google-microsoft-accounts", "guides/delivery-groups", "guides/http-provider", "guides/attachments", diff --git a/guides/connect-google-microsoft-accounts.mdx b/guides/connect-google-microsoft-accounts.mdx new file mode 100644 index 0000000..1f20db4 --- /dev/null +++ b/guides/connect-google-microsoft-accounts.mdx @@ -0,0 +1,220 @@ +--- +title: "Connect Google and Microsoft accounts" +description: "Prepare your organisation, import accounts, and authorise Google Workspace or Microsoft 365 mailboxes for sending." +keywords: + [ + "Google Workspace", + "Microsoft 365", + "Gmail OAuth", + "Outlook OAuth", + "bulk account authorisation", + "sending accounts", + ] +--- + +Use this guide to connect Gmail, Google Workspace, Outlook, or Microsoft 365 accounts that Sendmux will use for sending. For a large account pool, import the account list first, then authorise each pending account from its row. + + + You need permission to manage sending accounts in Sendmux and sign-in access + to every account you connect. If your organisation blocks third-party apps, + ask a Google Workspace or Microsoft Entra administrator to complete the + relevant preparation step below. + + +## Permissions Sendmux requests + +Sendmux requests only the permissions needed to identify the account, keep the connection active, and send email. + +| Provider | Sending permission | What it allows | +| --- | --- | --- | +| Google | `gmail.send` | Send email on behalf of the connected account. | +| Microsoft | Microsoft Graph delegated `Mail.Send` | Send email as the signed-in account. | + +The connection also requests basic identity scopes so Sendmux can confirm which account completed the flow. Microsoft includes `offline_access` so the account can remain connected without an interactive sign-in for every send. + +Connected accounts always send from the mailbox address that completed authorisation. You can set a sender display name and reply-to address, but a different **From Email** address requires a separately authorised account. + + + Sendmux does not need permission to read, change, or delete mailbox content. + Cancel the flow and contact Sendmux support if a provider prompt asks for + `Mail.Read`, `Mail.ReadWrite`, IMAP access, or permission to read and + permanently delete Gmail messages. + + +## Prepare Google Workspace + +Most organisations can skip this section. Complete it only when a Workspace policy blocks third-party apps or requires an administrator to configure them first. + + + + In the Google Admin console, open **Security** > **Access and data control** > **API controls**, then select **Manage App Access**. + + + Select **Configure new app**, search for `Sendmux`, and choose the Sendmux + OAuth app. Select the organisational units whose accounts will connect. + + + Choose **Specific Google data**. Allow the Google sign-in scopes and the + Gmail scope described as **Send email on your behalf**. Finish and review + the configuration before continuing. + + + +Google says changes can take up to 24 hours, though they often apply sooner. See Google's app access guide for current administrator roles and controls. + + + Administrator configuration allows the Sendmux app to request the approved + scopes. It does not connect every mailbox or give Sendmux domain-wide access. + Each account owner still completes the Sendmux authorisation flow. + + +## Prepare Microsoft 365 + +Most Microsoft 365 organisations allow the delegated `Mail.Send` permission without a separate administrator step. If your tenant blocks user consent, approve Sendmux once before connecting the account pool. + + + + Open **Accounts**, select **Add Account**, then choose **Outlook / Microsoft + 365**. + + + Expand **Organisation requires admin approval?** and select **Open Admin + Consent Page**. + + + An authorised Microsoft Entra administrator signs in and reviews the + delegated permissions. The sending permission must be Microsoft Graph + `Mail.Send`. Approve only if the prompt matches the permissions described + on this page. + + + Close the administrator tab after approval. Each account can now complete + its own **Authorise** flow. + + + +Tenant-wide consent allows users in the organisation to connect Sendmux. It does not connect their mailboxes automatically. See Microsoft's tenant-wide consent guide for current administrator roles and consent controls. + +## Connect one account + + + + Open **Accounts**, select **Add Account**, then choose **Gmail** or **Outlook + / Microsoft 365**. For Microsoft, keep **Global (Commercial)** selected. + + + Select **Connect Account**. Sign in to the exact account you intend to add. + + + Confirm the account address and the sending-only permission, then approve + the connection. New Google Workspace accounts may first show Google's + welcome page. Complete that page, then restart the connection from Sendmux. + + + Sendmux returns to **Accounts**. The account should show **Active**. If the + provider rejected or cancelled the flow, use **Authorise** or + **Re-authorise** beside the account to try again. + + + +## Connect a large account pool + +Importing creates the account records in one operation. Provider sign-in still happens once per account because each mailbox receives its own revocable OAuth credential. + + + + Open **Accounts** > **Accounts** > **Import Accounts**, then select + **Download template**. Keep the header row unchanged. + + Fill at least these columns for each connected account: + + | Column | Value | + | --- | --- | + | `name` | A unique account name. | + | `type` | `gmail_api` or `outlook_api`. | + | `oauth_user_email` | The account that must complete authorisation. | + + You can also set its delivery group, sender display name, reply-to details, + quotas, and routing weight in the same file. Sendmux ignores `from_email` + for connected accounts and uses `oauth_user_email` as the sender address. + + + Upload the file, review accepted and rejected rows, then select **Import**. + New Google and Microsoft accounts appear as **Pending** because imported + files never contain connected-account credentials. + + + Filter the account list by **Pending**. Select **Authorise** beside the first + account, verify the email address at Google or Microsoft, and complete the + provider flow. Repeat for the remaining accounts. + + + Remove the **Pending** filter and confirm every connected account is + **Active**. Review any **Error** row and use **Re-authorise** after correcting + the provider-side issue. + + + + + Prepare Google or Microsoft administrator consent before starting a large + batch. This removes organisation-policy interruptions, while keeping each + mailbox connection separate and revocable. + + +## Troubleshooting + + + + Pending is expected until that account completes OAuth. Select + **Authorise** beside the account. If the action is not visible, confirm that + your Sendmux role can manage sending accounts, then refresh the page. + + + + Do not continue through **Advanced**. The expected Gmail permission is + **Send email on your behalf**. Cancel the flow and contact Sendmux support + with the team, account address, and time of the attempt. + + + + Use **Add Account** > **Outlook / Microsoft 365** > **Organisation requires + admin approval?** > **Open Admin Consent Page**. After an authorised Entra + administrator approves delegated `Mail.Send`, restart **Authorise** for the + affected account. + + + + Cancel the provider flow. Return to the matching account row and select + **Authorise** again. Check the address shown by the provider before you + approve access, especially when several accounts are signed in in the same + browser. + + + + Stop repeating the flow. Refresh **Accounts** and retry once from the + account's own **Authorise** or **Re-authorise** action. If the message + returns, contact Sendmux support with the team, account address, and + timestamp. This message is not a sending-account capacity limit. + + + +## Related guides + + + + Import, configure, monitor, and route sending accounts. + + + Route sending keys through a selected account pool. + + + Build a GTM sending pool with per-account caps. + + + Give operators the role they need to manage accounts. + + diff --git a/guides/sending-accounts.mdx b/guides/sending-accounts.mdx index ef36ee9..5caef0d 100644 --- a/guides/sending-accounts.mdx +++ b/guides/sending-accounts.mdx @@ -56,7 +56,9 @@ Use your own provider when you need higher volume, a specific sender policy, or SMTP accounts need server address, port, protocol, username, password, and optional sender defaults. Connected accounts send you through the provider's - sign-in flow. + sign-in flow. See + [Connect Google and Microsoft accounts](/guides/connect-google-microsoft-accounts) + for administrator preparation, permissions, and large account pools. For SMTP accounts, use **Test Connection** after saving. Fix any credential @@ -98,7 +100,8 @@ formatting. JSON configuration files never contain or accept passwords or connected-account credentials. Use them to update matched accounts. To create a new SMTP account, use **Add Account** or a CSV with its password. Use **Add Account** to authorise - a new Gmail or Outlook account. + a new Gmail or Outlook account, or import its account record and select + **Authorise** from the pending account row. @@ -121,7 +124,7 @@ formatting. | `password` or `smtp_password` | New SMTP account | SMTP password. Exports leave this blank. A blank value on update keeps the current password. | | `status` | No | `active` or `inactive`. New SMTP accounts default to `active`. | | `oauth_user_email` | New Gmail or Outlook account | Email address used to match the account. A new imported account remains pending. | - | `from_email`, `from_name` | No | Default sender address and display name. | + | `from_email`, `from_name` | No | Default sender address and display name. `from_email` applies only to SMTP accounts; connected accounts use `oauth_user_email`. | | `reply_to_email`, `reply_to_name` | No | Default reply-to address and display name. | | `tracking_domain` | No | Custom tracking hostname. | | `quota_second`, `quota_minute`, `quota_hour`, `quota_day` | No | `0` for unlimited, one number, or a range such as `5-10`, up to `100000000`. | @@ -210,6 +213,13 @@ Each team starts with **200 sending accounts** that you add yourself. The manage ## Related guides + + Prepare administrator access and authorise connected accounts at scale. + Group providers and route selected keys or mailboxes through them. diff --git a/openapi-app.json b/openapi-app.json index 72dbd9e..1b19aa1 100644 --- a/openapi-app.json +++ b/openapi-app.json @@ -5386,6 +5386,7 @@ "additionalProperties": false, "properties": { "from_email": { + "description": "Default From email address for an SMTP account.", "example": "sender@example.com", "format": "email", "maxLength": 255, @@ -5631,7 +5632,7 @@ "type": "string" }, "from_email": { - "description": "Default From email address.", + "description": "Default From email address. Connected Google and Microsoft accounts always use their authorised account address.", "type": [ "string", "null" @@ -6140,6 +6141,7 @@ "additionalProperties": false, "properties": { "from_email": { + "description": "Default From email address for an SMTP account. Connected Google and Microsoft accounts keep their authorised account address.", "example": "sender@example.com", "format": "email", "maxLength": 255,