`XOAUTH2` / `OAUTHBEARER` support

I heard about Nylas recently and I can see that AI assisted dev appears to be leveraged quite a bit (this made the docs experience a bit less pleasant personally and tends to add skepticism/trust concerns for adopting such projects for me, but I am also aware of the perks).

Feature to support - Bearer token authentication via XOAUTH2 / OAUTHBEARER (authentication through SMTP/POP/IMAP protocols)

Presently I'm quite fond of swaks for the usage I have, but it's development has stalled (as it had for some time before a slight return of activity before becoming inactive again around 2 years ago). In particular I really wanted to see this feature PR land (support for auth via OAUTHBEARER / XOAUTH2).

Instead, for a test suite that requires verifying this support via CLI commands, I am using curl as a workaround (additional information for test environment), which looks like this:

• IMAP - Via Dovecot (which verifies the bearer token against a configured identify provider) with authentication on port 143 (aka IMAP using StartTLS):

  curl --silent \
    --login-options "AUTH=${AUTH_METHOD}" --oauth2-bearer "${ACCESS_TOKEN}" --user "${USER_ACCOUNT}" \
    --url 'imap://localhost:143' -X 'LOGOUT'
  

• SMTP - Via Postfix (auth delegated to the Dovecot SASL provider) with authentication on port 587 (aka submission port using StartTLS):

  curl --silent \
    --login-options "AUTH=${AUTH_METHOD}" --oauth2-bearer "${ACCESS_TOKEN}" --user "${USER_ACCOUNT}" \
    --url 'smtp://localhost:587' --mail-from "${USER_ACCOUNT}" --mail-rcpt "${USER_ACCOUNT}" --upload-file - <<< 'RFC 5322 content - not important'
  

Any mail client that has support for either AUTH_METHOD set for either command above (XOAUTH2 / OAUTHBEARER) would be compatible with authenticating this way to the Dovecot IMAP service.

• It'd be nice if Nylas were capable of it too (seems to be lacking from the comparison page).
• OAUTHBEARER is the more modern standard FWIW (standardized in 2015), with XOAUTH2 (Google's earlier method) still having adoption AFAIK but otherwise deemed legacy/deprecated.

Additional References:

• Since you already have provider support with Microsoft Outlook, it might be worth noting they have Office 365 related docs on SASL XOAUTH2 support (also details usage with IMAP, POP, and SMTP protocols).
• A real world setup shared by a user (in late 2025) using a variety of OSS software (which presumably Nylas could simplify). I've also setup Roundcube (Webmail client) to authenticate through Dovecot and an OIDC login flow.

Nylas documents a fixed set of OAuth2 providers, but one is listed as "IMAP". The associated docs page is rather sparse on this front (and that recommended guides section is massive in comparison despite being largely irrelevant to the page itself). I'm assuming this concern is due to either the docs being generated and/or the age of the Nylas which seems fairly young.

I would assume that the IMAP auth provider was more than just standard username + password credentials, given this page states:

Nylas CLI

A modern, open-source CLI (MIT licensed) that connects to Gmail, Outlook, Exchange, Yahoo, iCloud, and any IMAP provider through OAuth.

Somewhat misleading there?

I've not yet felt compelled to try Nylas out locally to better verify, a quick search over this repo for the IMAP provider and XOAUTH2 / OAUTHBEARER keywords suggests there is no support in place.

Consulting Gemini also suggests no support (not sure why it's deemed SMTP and IMAP protocols as "legacy" though):

No, Nylas does not support XOAUTH2 or OAUTHBEARER in the way you are thinking.

Because XOAUTH2 and OAUTHBEARER are SASL mechanisms explicitly designed to pass OAuth2 tokens over legacy TCP protocols like SMTP and IMAP, they don't apply to Nylas.