OAuth scopes for email cleaners: understanding what is safe
TL;DR
OAuth tokens grant API capabilities without exposing passwords, but excessive scopes create real risk. Choose tools using minimal modify scopes with full user consent.
When you connect a third-party application to your Google account, the consent screen presents a list of technical permissions known as OAuth scopes. Google designed OAuth 2.0 to protect your credentials: applications receive a cryptographic access token rather than your username and password.
However, many users treat OAuth as a binary trust decision: either you approve the app or you do not. In practice, the specific OAuth scopes requested by an email cleaner determine the boundary between a secure helper and an unacceptable security risk. Understanding these scopes enables you to grant only the privileges an application genuinely requires.
How Google API scopes govern email access
Google partitions the Gmail API into specific permission scopes. Each scope authorizes distinct operations, from read-only inspection to destructive account reconfiguration.
Here is how the primary Gmail API scopes compare:
| Scope URI | Scope Name | Capabilities | Appropriateness for Cleanup |
|---|---|---|---|
.../auth/gmail.readonly | Read-only | View email metadata, message bodies, and labels. Cannot modify or move messages. | Useful for read-only audits, but cannot apply cleanup actions. |
.../auth/gmail.modify | Modify | Read messages and modify labels, archive threads, or send messages to Trash. | Ideal for triage tools where user approval drives label actions. |
.../auth/gmail.labels | Manage labels | Create, update, and delete mailbox labels only. | Insufficient on its own to triage messages. |
.../auth/gmail.send | Send mail | Compose and send new messages or replies. | Red flag for cleanup tools; unnecessary for organization. |
.../auth/gmail.settings.basic | Manage settings | Adjust filters, signatures, and forwarding addresses. | Unnecessary for standard inbox cleanup. |
https://mail.google.com/ | Full access | Complete read, write, permanent purge, and account settings access. | Excessive risk. Never grant this to a standalone cleanup utility. |
An email cleaner needs to read incoming message attributes to determine which emails are newsletters, updates, or receipts, and it needs the ability to archive or trash those messages once approved. Consequently, gmail.modify provides the exact surface area required.
The dangers of excessive permission requests
If an email management tool asks for https://mail.google.com/ or gmail.send, caution is warranted. These broad permissions introduce avoidable hazards:
- Irreversible data deletion: The full access scope allows apps to execute permanent purges bypassing the 30-day Gmail Trash safety net.
- Mailbox forwarding manipulation: Attackers targeting compromised third-party tokens can set up silent email forwarding rules, intercepting password reset messages from banking and corporate services.
- Unauthorized outbound communication: A compromised application with
gmail.sendcould dispatch phishing campaigns or sensitive replies from your legitimate address.
A well-architected email management tool adheres to the principle of least privilege: requesting only the minimal permissions required to accomplish its stated features.
How PureBox implements minimal OAuth boundaries
As documented in our Privacy Policy, PureBox requests only the https://www.googleapis.com/auth/gmail.modify scope during the Gmail connection flow (it does not request userinfo.email or the broader https://mail.google.com/ scope, and identifies the connected mailbox via Gmail users.getProfile). While Google's gmail.modify scope technically encompasses read/write message operations other than permanent deletion, PureBox contractually commits in its Privacy Policy that read access powers scan and classification, write access executes only the actions you authorize, and we never delete messages permanently and never send mail on your behalf.
PureBox deliberately avoids:
- Full mailbox access (
https://mail.google.com/), which permits immediate permanent purges - Settings and forwarding modifications (
gmail.settings.basicorgmail.settings.sharing) - Permanent purge operations (messages moved to Trash remain in Gmail's native Trash for 30 days)
Most importantly, access permissions are paired with human oversight. By default (and always on the Free plan), you approve what moves across canonical tracks - Inbox, Archive, and Trash - before changes are applied to your Gmail account.
How to verify requested scopes during authorization
When connecting any third-party productivity application to Gmail, verify the OAuth screen with these checks:
- Expand permission details: On Google's OAuth consent prompt, click the information icons or expandable details to review the requested permissions.
- Verify the developer identity: Check the application identity and redirect domain on the consent screen.
- Compare against the privacy policy: Confirm that the vendor's privacy policy explains why each scope is requested and commits to the Google API Services User Data Policy (Limited Use requirements).
Editorial verification and legal remarks
Fact-check & legal notice (as of 2026-10-22): Descriptions of Gmail API scopes reflect Google's official Gmail API scope documentation reviewed on 2026-10-22. OAuth is an authorization mechanism, not by itself proof of privacy or regulatory compliance. For PureBox's binding commitments, see our Privacy Policy, Terms of Service, Sub-processors list, and B2B Data Processing Addendum.
Frequently asked questions
What is the difference between gmail.readonly and gmail.modify?
The gmail.readonly scope allows an application to read message headers, bodies, and attachments without the ability to make changes. The gmail.modify scope allows reading as well as applying label changes, archiving, and trashing messages, which is necessary for triage tools.Why should you avoid email cleaners requesting full mail.google.com access?
The https://mail.google.com/ scope grants unrestricted access to your entire Google Mail account, including the ability to permanently delete messages immediately, alter forwarding rules, and draft outbound emails. Cleanup tools do not need this level of privilege.Can an email cleaner send emails on your behalf without permission?
Not unless you grant the gmail.send or full mail.google.com scope. Focused triage applications like PureBox do not request sending scopes and cannot generate or transmit outbound messages from your account.
Ready to give your inbox the calm treatment?
No-card Free scan · Review before applying