# Gmail OAuth Refresh Token Guide

This folder contains scripts to obtain a Gmail OAuth refresh token for applications that need to send emails via Gmail API.

## Prerequisites

1. **Google Cloud Console Account**
   - Go to https://console.cloud.google.com/
   - Create a new project or select existing one

2. **Enable Gmail API**
   - Navigate to "APIs & Services" > "Library"
   - Search for "Gmail API" and enable it

3. **Create OAuth Credentials (Web Application)**
   - Go to "APIs & Services" > "Credentials"
   - Click "Create Credentials" > "OAuth client ID"
   - Select "Web application" as the type
   - Add `http://localhost:8085/` as an authorized redirect URI
   - Click "Create"
   - Save your **Client ID** and **Client Secret**

## Method: Manual Authorization Code Exchange

This method is reliable and doesn't require a local HTTP listener.

### Step 1: Configure the Script

1. Open `Exchange_Code_For_Token.ps1` in a text editor
2. Replace the placeholders:
   ```powershell
   $ClientId = "YOUR_CLIENT_ID.apps.googleusercontent.com"
   $ClientSecret = "YOUR_CLIENT_SECRET"
   ```

### Step 2: Get Authorization Code

1. Open this URL in your browser (replace `YOUR_CLIENT_ID`):
   ```
   https://accounts.google.com/o/oauth2/v2/auth?client_id=YOUR_CLIENT_ID.apps.googleusercontent.com&redirect_uri=http://localhost:8085/&response_type=code&scope=https://www.googleapis.com/auth/gmail.send&access_type=offline&prompt=consent
   ```

2. Sign in with your Google account

3. Click "Allow" to grant permission

4. The browser will show "Page not found" - **THIS IS EXPECTED!**

5. Copy the **full URL** from the address bar. It looks like:
   ```
   http://localhost:8085/?code=4/0AfJohX...&scope=https://www.googleapis.com/auth/gmail.send
   ```

6. Extract the authorization code (the part between `code=` and `&scope=`)

### Step 3: Exchange Code for Refresh Token

1. Paste the authorization code into the script:
   ```powershell
   $AuthCode = "4/0AfJohX..."  # Your extracted code
   ```

2. Run the script:
   - Double-click `Get_Refresh_Token.bat`, OR
   - Run in PowerShell:
     ```powershell
     .\Exchange_Code_For_Token.ps1
     ```

3. The script will display your **Refresh Token** (starts with `1//...`)

### Step 4: Store the Token

1. Copy the refresh token
2. Store it securely in your application's configuration
3. The refresh token is long-lived (valid until you revoke it)

## Troubleshooting

### "invalid_client" Error
- Ensure you're using the **Web application** client type (not Desktop)
- Verify Client ID and Client Secret match exactly
- Check that the redirect URI in the URL matches your Google Cloud Console settings exactly

### "redirect_uri_mismatch" Error
- The redirect URI in the authorization URL must exactly match what's configured in Google Cloud Console
- Must include trailing slash: `http://localhost:8085/`

### "invalid_grant" Error
- Authorization codes expire quickly (a few minutes)
- Get a fresh authorization code and try again

### Token Not Received
- Ensure you included `prompt=consent` in the authorization URL
- This is required to get a refresh token (not just an access token)

## Security Notes

- **Never commit your credentials** to version control
- **Client Secret** should be treated as a password
- **Refresh Token** is equivalent to a password - store it securely
- Use environment variables or secure credential storage in production

## Files in this Folder

| File | Purpose |
|------|---------|
| `Exchange_Code_For_Token.ps1` | PowerShell script to exchange authorization code for refresh token |
| `Get_Refresh_Token.bat` | Batch wrapper to run the PowerShell script |
| `README.md` | This documentation file |

## Alternative: Automated Localhost Flow

For an automated flow with a local HTTP listener, you would need to:
1. Start an HTTP listener on port 8085
2. Open the browser automatically
3. Capture the callback and extract the code
4. Exchange for tokens

However, this method (manual code extraction) is more reliable and doesn't require elevated permissions or firewall exceptions.
