# Secure email delivery with XOAUTH2

DevFeed: [Secure email delivery with XOAUTH2](<https://devfeed.tech/articles/secure-email-delivery-with-xoauth2-31710.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2025/05/send-mails-xoauth-26-2>)

Author: Sebastian Rose

Published: 2025-05-18T00:00:00Z

Content type: tutorial

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [Azure](<https://devfeed.tech/topics/azure.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [notifications](<https://devfeed.tech/topics/notifications.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [password reset](<https://devfeed.tech/topics/password-reset.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [azure](<https://devfeed.tech/tags/azure.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [email-delivery](<https://devfeed.tech/tags/email-delivery.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [notifications](<https://devfeed.tech/tags/notifications.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [password](<https://devfeed.tech/tags/password.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [saml](<https://devfeed.tech/tags/saml.md>), [smtp](<https://devfeed.tech/tags/smtp.md>), [sso](<https://devfeed.tech/tags/sso.md>), [using](<https://devfeed.tech/tags/using.md>)

## AI overview

Keycloak 26.2 adds XOAUTH2 support to SMTP authentication, allowing token-based email delivery with client credentials. The article explains how to configure and test the feature, including Microsoft Azure, and notes that Google requires additional functionality and is not yet supported.

## Source excerpt

Keycloak relies on email functionality for tasks like password resets, user verifications, and notifications. A common setup is for Keycloak to authenticate to the SMTP server with a username and password. With issue #17432, the Keycloak community raised the need for token-based authentication with XOAUTH2, as some providers deprecated the authentication for SMTP with passwords. With Keycloak 26.2, the SMTP AUTH configuration now supports XOAUTH2. As Keycloak's role is that of an application, it uses the client credentials grant to fetch the token. The SMTP AUTH configuration in Keycloak now supports all required fields to fetch such a token with client id and client secret. When implementing this functionality, I found that while it works with Microsoft Azure and Office365, it would need a different mechanism for providers like Google. So let's follow through this example, and then discuss if we need something different from SMTP altogether. Configuring Keycloak to send emails with XOAUTH2 The following assumes that you are working with Keycloak 26.2. In a realm, navigate to Realm Settings -> Email and fill in the fields. To see the new XOAUTH2 feature, enable Authentication via the radio-button and switch the Authentication Type from Password to Token. You can find further details in the documentation on sending emails. ' ' '