FOLD Documentation
Early access
Accounts and identities

Sign in with Google

Google accounts sign in on Google's own login page with OAuth 2.0 and PKCE, so FOLD never sees or stores your Google password.

How the sign-in works

When FOLD recognizes a Google address (gmail.com or googlemail.com), the setup shows Sign in with provider (OAuth) instead of a password field. This works the same way on the Mac, iPhone and iPad.

  1. FOLD opens Google’s login page in the system’s sign-in window, not in a view that FOLD controls.
  2. You sign in with Google, including any two-step verification, and allow access to your mail.
  3. Google hands control back to FOLD, and FOLD creates the account.

Technically FOLD uses the OAuth 2.0 authorization code flow with PKCE (method S256), which is mandatory for every sign-in. FOLD is registered as a public client and carries no client secret. The requested scope is Google’s full mail access, which IMAP and SMTP require. Both protocols then authenticate with XOAUTH2.

The tokens Google issues are stored in the keychain of the device. FOLD renews the access token by itself when it expires. OAuth tokens are never synced to iCloud, not even when you turn on password sync.

Revoking access

When you remove the account in FOLD, its tokens are deleted from the keychain. To revoke FOLD’s access on Google’s side as well, remove FOLD from the third-party access list in your Google account.

Other Google addresses

FOLD offers Google sign-in only for addresses it recognizes as Google, which today are gmail.com and googlemail.com. For an address on your own domain that is hosted by Google, use manual setup with an app password from your Google account.

Microsoft accounts

FOLD recognizes Outlook.com, Hotmail, Live and MSN addresses, and the Microsoft profile requires OAuth. Microsoft sign-in is not available yet because FOLD does not have a registered Microsoft client; the attempt ends with an error. Microsoft sign-in is planned. Until then, FOLD offers no supported way to add a Microsoft account.

App passwords

Many providers let you create an app-specific password in their account settings. You enter it like a normal password, and FOLD never learns your main password.

  • On iPhone and iPad, the OAuth step offers Set up manually instead, with the hint “If provider sign-in doesn’t work: many providers allow an app password.”
  • On the Mac, choose Set up manually on the first setup step.

For iCloud Mail, Yahoo Mail, Fastmail and Zoho Mail an app password is the regular way in; see Built-in providers.