IMAP vs OAuth: Email Access Explained
When you connect any tool to your email, you're trusting it with access to your inbox, but the mechanism behind that access matters more than most people realize. IMAP and OAuth are genuinely different trust models, not just two technical options that do the same thing.
What IMAP access actually means
IMAP is an older protocol, and it works with a username and a password, usually an app-specific password generated separately from your main one. The important detail: IMAP itself has no concept of partial access. Whatever credential you hand over has full access to the mailbox, read, send, delete, everything. There's no built-in way to say "read-only" at the protocol level. Whatever access control exists has to be built by the tool itself, not guaranteed by the protocol.
What OAuth access means
OAuth works differently. Instead of handing over a password, you authorize an app through your email provider's own consent screen, and the provider issues a token scoped to specific permissions, read-only being one of them. Your actual password is never shared with the app at any point. If you want to cut access, you revoke the token directly from your Google or Microsoft account settings, no password change required, and it takes effect immediately.
Why "read-only" as a specific scope matters
A tool running on a read-only OAuth scope literally cannot send, delete, or modify anything in your mailbox, even if it wanted to or had a bug that tried to. That's not a policy promise, it's enforced by the provider at the permission level. This is a meaningfully smaller blast radius than a full-access IMAP credential, where nothing stops the tool from doing more than reading, the only thing standing between "read-only" and "full access" is how carefully the tool's own code was written.
When IMAP still makes sense
OAuth isn't universally available. Some older email providers, self-hosted mail servers, and certain business setups don't support it, and IMAP remains the only practical option there. That's a legitimate reason to keep IMAP as a fallback, not a reason to prefer it when OAuth is available.
What to actually check before granting access
Before connecting any tool to your email, it's worth looking for three things: whether it uses OAuth with a read-only scope rather than IMAP with a full-access credential, whether the permissions it requests are named explicitly rather than bundled vaguely, and whether you can revoke access from your own account settings without needing to change a password or contact support.
InboxDoc connects via read-only OAuth for Gmail and Outlook, with IMAP available as a fallback where OAuth isn't an option. Start a free trial and process your first 5 invoices at no cost, no credit card required.