For authentication it will get a token, and then using the token it will make a XOAUTH2 AUTHENTICATE request.The IMAPStore now checks for capability for authentication via XOAuth 2 and SASL-IR.If you do that it will use the AccountManager to try and fetch a token for the email address you provide.You can now select to authenticate incoming using an OAuth 2.0 token.There's a new xoauth2 branch from work I've done so far. Whether putting the 'client secret' in a public repo is acceptable to Google is a good question. While I'd want the developer to do it in a provider neutral fashion as possible, until you have two it's impossible to know what the changes will be - they could have no concept of token refresh for example. It may or may not be the same for different providers. But much of it is Google's implementation. Some of this is common across anyone who uses XOAuth2. Use the refresh code to periodically refresh the access code (1 hour for Google).Use the action code to login (this is quite similar to CRAM_MD5).Store the refresh code and action codes as their pseudo-passwords.Implement a follow-on screen to accept the verification code and generate an access code and refresh code.Implement a screen for users to allow K-9 access to their email (or just a link to an external browser window).Obtain a client ID and 'Secret' for K-9 (which will have to be in the APK so may as well be in the repo).Implementing XOAuth2 for Google will require us to:

K9mail oauth2