---
title: "Register the email-oauth2-proxy component"
slug: "register-the-email-oauth2-proxy-component"
updated: 2026-07-23T15:16:23Z
published: 2026-07-23T15:16:23Z
canonical: "docs.senhasegura.io/register-the-email-oauth2-proxy-component"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Register the email-oauth2-proxy component

The `email-oauth2-proxy` component runs a local proxy on the Segura® server that adds OAuth2.0 authentication to SMTP and IMAP connections. Use it for mail provider that requires OAuth2.0.

Info

For a Microsoft-hosted mailbox, use the native Authenticate flow instead: see [Configure OAuth2.0 authentication for SMTP and IMAP via Azure](/v4-2/docs/configure-oauth2-0-authentication-for-smtp-and-imap-via-azure). It does not require this proxy. Use the proxy for a Microsoft mailbox only if the native flow does not fit your environment.

## Requirements

- Administrative access to the Segura® server.
- The `client_id`, `client_secret`, and `tenant_id` for your mail provider's OAuth2.0 app.

To obtain the `client_id`, `client_secret`, and `tenant_id`, register the Segura® solution with your provider:

- Office 365: [Office 365 Quickstart Register App](https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).
- Office 365: [How to find your Microsoft Entra tenant ID](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/how-to-find-tenant).
- Google Workspace: [OAuth 2.0 for Mobile & Desktop Apps](https://developers.google.com/identity/protocols/oauth2/native-app).

## Register the proxy

1. Access the Segura® server using SSH on port `59022`.
2. Log in with the administrative user `mt4adm`.
3. Run `orbit email-oauth2-proxy register` with your `client_id`, `client_secret`, and `tenant_id`, and the following parameters:

```
orbit email-oauth2-proxy register \
 --imap-server-address=outlook.office365.com \
 --imap-server-port=993 \
 --smtp-server-address=smtp.office365.com \
 --smtp-server-port=587 \
 --smtp-server-starttls \
 --oauth2-token-url="https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token" \
 --oauth2-permission-url="https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize" \
 --oauth2-scope="https://outlook.office365.com/IMAP.AccessAsUser.All https://outlook.office365.com/SMTP.Send offline_access" \
 --oauth2-flow="client_credentials" \
 --oauth2-client-id="CLIENT_ID" \
 --oauth2-client-secret="CLIENT_SECRET" \
 --force
```

The following example shows a configuration file for Microsoft Office 365:

```
[emailproxy]
delete_account_token_on_password_error = True
encrypt_client_secret_on_first_use = False
allow_catch_all_accounts = True
[IMAP-2993]
server_address = outlook.office365.com
server_port = 993
[SMTP-2465]
server_address = smtp.office365.com
server_port = 587
starttls = True
[@]
redirect_uri = http://<Your_Vault_Address>/email-oauth2-proxy-authorize/
redirect_list_address = http://127.0.0.1:8801/
token_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token
permission_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize
oauth2_scope = https://outlook.office365.com/IMAP.AccessAsUser.All https://outlook.office365.com/POP.AccessAsUser.All https://outlook.office365.com/SMTP.Send offline_access
client_id = CLIENT_ID
client_secret = CLIENT_SECRET
oauth2_flow = client_credentials
```

## Point the mail account at the proxy

After you register the proxy, configure your SMTP or IMAP account in Segura® to connect to the local proxy instead of the provider directly. Use the local address `127.0.0.1` and the port assigned to each protocol in the configuration, for example `2465` for SMTP and `2993` for IMAP.

- SMTP: see [Manage SMTP settings](/v4-2/docs/how-to-manage-smtp-settings).
- IMAP/POP3: see [Manage IMAP/POP3 settings](/v4-2/docs/how-to-manage-imappop3-settings).

## Validate the proxy authentication

After you configure the mail account, obtain the authorization URL from the proxy to complete authentication with the provider:

1. Run `orbit email-oauth2-proxy logs` in the terminal. In the output, find the message **Please visit the following URL to authenticate account** to get the validation URL.
2. Copy the full URL and paste it into a browser.
3. Log in to the account.

The browser confirms that OAuth2.0 authentication succeeded.

Info

For an overview of the available commands, run `orbit email-oauth2-proxy -help`.