MailKit OAuth2 SMTP Gmail Send Mail

[Zz-ing]

We used MailKit before, but now more and more service providers no longer support basic auth smtp, so we now need to inherit Oauth2 authentication method. We use Mailkit, but it keeps prompting me

public async Task SendEmailAsync(string from, string to, string subject, string body)
{
    var message = new MimeMessage();
    message.From.Add(new MailboxAddress(from, from));
    message.To.Add(new MailboxAddress(to, to));
    message.Subject = subject;

    var bodyBuilder = new BodyBuilder { TextBody = body };
    message.Body = bodyBuilder.ToMessageBody();

    using (var client = new SmtpClient())
    {
        await client.ConnectAsync(smtpServer, 587, SecureSocketOptions.StartTls);

        // from is my google gmail address
        var oauth2 = new SaslMechanismOAuth2(from, this.AccessToken);
        try
        {
            // MailKit.Security.AuthenticationException: '535: 5.7.8 Username and Password not accepted. For more information, go to
            // 5.7.8  https://support.google.com/mail/?p=BadCredentials d2e1a72fcca58-71e774a2b2bsm4392811b3a.111 - gsmtp'
            await client.AuthenticateAsync(oauth2, CancellationToken.None);
        }
        catch (Exception e)
        {
            await Console.Out.WriteLineAsync("Exception");
        }

        await client.SendAsync(message);
        client.Disconnect(true);
    }
}

We mainly use it to send emails, I looked at https://github.com/jstedfast/MailKit/blob/master/GMailOAuth2.md#obtaining-an-oauth2-client-id-and-secret but didn't find a solution， I looked at this question, MailKit OAuth2 SMTP Office365 Send Mail But I still can't solve it.
thank you very much!

[jstedfast]

I don't see any code to verify that the access token is still valid (e.g. not stale). Is that being done somewhere else?

Access tokens only last for a short period of time (a few hours? a day? depends on the service I think)

[Zz-ing]

Thank you very much for your prompt response to this question.
In this experimental code，I have verified the validity of the access token, and I used Postman to request some Gmail APIs, which are all acceptable.
The following code is how I get the Oauth authorization code, I will click a link to complete the certification, similar to the link below, It will return an authorized code
https://accounts.google.com/o/oauth2/v2/auth?client_id=xxxxx.apps.googleusercontent.com&redirect_uri=http://localhost:5123/WeatherForecast/OAuthCallback&response_type=code&scope=https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/gmail.readonly https://www.googleapis.com/auth/gmail.send https://www.googleapis.com/auth/calendar&state=44&access_type=offline&prompt=consent

var clientID = "xxxxx.apps.googleusercontent.com";
var clientPassword = "yyyyyyy";
var queries = new
{
    client_id = "xxxx.apps.googleusercontent.com",
    redirect_uri = @"http://localhost:5123/WeatherForecast/OAuthCallback",
    response_type = "code",
    /*
     "https://www.googleapis.com/auth/userinfo.profile",
     "https://www.googleapis.com/auth/userinfo.email",
     "https://www.googleapis.com/auth/gmail.readonly",
     "https://www.googleapis.com/auth/gmail.send",
     "https://www.googleapis.com/auth/calendar"
     */
    scope = EmailService_Oauth.GetScopes(),
    state = new Random().Next(1, 5000),
    access_type = "offline",
    prompt = "consent",
};

After getting the authorization code, I obtained the token and Refreshtoken and Token expires by calling the Google interface.

// get token and refreshtoken
try
{
    // token url: "https://oauth2.googleapis.com/token"
    var response = await new HttpClient().PostAsync(TokenUrl, new FormUrlEncodedContent(
        new Dictionary<string, string>()
        {
            { "client_id", clientID },
            { "client_secret", clientSecurity },
            { "code", authorizeCode },
            { "grant_type", "authorization_code" },
            { "redirect_uri", @"http://localhost:5123/WeatherForecast/OAuthCallback" }
        }));

    if (!response.IsSuccessStatusCode)
    {
        await Console.Out.WriteLineAsync(await response.Content.ReadAsStringAsync());
        await Console.Out.WriteLineAsync("failed!");
        return;
    }
    var response_Content = await response.Content.ReadAsStringAsync();
    var tokenResponse = JsonHelper.DeserializeFrom<TokenResponse>(await response.Content.ReadAsStreamAsync());

    this.AccessToken = tokenResponse.AccessToken;
    this.RefreshToken = tokenResponse.RefreshToken;
    this.ExpiresAt = DateTime.Now.AddSeconds(tokenResponse.ExpiresIn);

    await Console.Out.WriteLineAsync();
    Console.WriteLine($"accessToken: {this.AccessToken}");
    Console.WriteLine($"refreshToken: {this.RefreshToken}");
    Console.WriteLine($"expiresAt: {this.ExpiresAt.ToString()}");
}
catch (Exception e)
{
    await Console.Out.WriteLineAsync("Exception");
}

So the token I passed to Mailkit was obtained from here

this is my scopes express settings

In order to better verify that I was introduced to Mailkit's token, it was correct. I wrote a Console App Project and sent emails with Gmail API. After I run, this project is working normally. The code is as follows:

public class Program
{
    public static async Task Main(string[] args)
    {
        var accessToken = "xxxxxxx"; // OAuth 2.0 Access Token
        var to = "[email protected]";
        var from = "[email protected]";
        var subject = "subject";
        var body = "Use gmail send email body";

        var message = $"From: {from}\r\n" +
                      $"To: {to}\r\n" +
                      $"Subject: {subject}\r\n\r\n" +
                      $"{body}";

        var rawMessage = Convert.ToBase64String(Encoding.UTF8.GetBytes(message))
                            .Replace("+", "-")
                            .Replace("/", "_")
                            .Replace("=", "");

        using var httpClient = new HttpClient();
        httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);

        var requestBody = new { raw = rawMessage };
        var content = new StringContent(System.Text.Json.JsonSerializer.Serialize(requestBody), Encoding.UTF8, "application/json");

        var response = await httpClient.PostAsync("https://gmail.googleapis.com/gmail/v1/users/me/messages/send", content);
        if (response.IsSuccessStatusCode)
        {
            Console.WriteLine("Send Success");
        }
        else
        {
            Console.WriteLine($"Send failed: {response.ReasonPhrase}");
        }
    }
}

[jstedfast]

What scope are you using in your with request?

[Zz-ing]

Thank you for your response.
I'm not quite sure what specific request you're referring to? Does it refer to the following content?
Scope for obtaining authorization code
/*

" https://www.googleapis.com/auth/userinfo.profile ",

" https://www.googleapis.com/auth/userinfo.email ",

" https://www.googleapis.com/auth/gmail.readonly ",

" https://www.googleapis.com/auth/gmail.send ",

" https://www.googleapis.com/auth/calendar "

*/

[jstedfast]

Those are all scopes, yes, but they are not the correct scopes which is why it is failing for you.

You need to use specifically "https://mail.google.com/" and ONLY that scope in order to authenticate via "legacy protocols" like SMTP.

[Zz-ing]

Thank you for your help. I solved the problem of using Mailkit for Oauth authentication to send emails under Gmail.
But I still have a question, if I am Outlook, what should I set these to? Because in the Gmail problem above, the Scope I set can work normally when sending using the Gmail API. This would make me mistakenly think that it is a mailkit problem, not a problem with my own settings.
What do you think if there is a setting table that can better help users?

[jstedfast]

I've already documented this in https://github.com/jstedfast/MailKit/blob/master/GMailOAuth2.md

[Zz-ing]

I have read this document, but not careful enough, I'm sorry to delay your time.

[DamijanD]

I will ask here because it is connected to the original question:
Is it possible to use MailKit with "https://www.googleapis.com/auth/gmail.send" scope in order to send mail? I know that it can't be done via smtp but is there any other way?

[jstedfast]

The "gmail.send" scope is ONLY for their HTTP REST API that you'd have to use Google.Apis.Gmail.v1 for.

[DamijanD]

Thx. And probably there is no plan to include this approach in MailKit?

[jstedfast]

Correct. There doesn't seem to be much value in competing with Google to support their own APIs 😁