Skip to content

Remove OAuth2, use app password auth only#6

Merged
gumruyanzh merged 1 commit into
mainfrom
remove-oauth2
Feb 25, 2026
Merged

Remove OAuth2, use app password auth only#6
gumruyanzh merged 1 commit into
mainfrom
remove-oauth2

Conversation

@gumruyanzh

Copy link
Copy Markdown
Contributor

Summary

  • Remove all OAuth2 code (oauth.go, xoauth2.go, token.go) — Yahoo no longer grants mail-r/mail-w API permissions to new apps
  • Simplify auth to app-password-only (LOGIN/PLAIN for IMAP/SMTP)
  • Remove OAuth credential injection from Makefile, goreleaser, and CI workflow
  • Remove oauth_port config key, AuthMethod enum, and OAuth token storage
  • Update README for app-password-only workflow — no credentials needed to build from source

Test plan

  • go build ./... compiles without errors
  • go vet ./... — no warnings
  • grep -r "oauth\|OAuth\|XOAUTH\|xoauth" internal/ cmd/ — no OAuth references remain
  • golang.org/x/oauth2 removed from go.mod
  • yoy auth login --email test@yahoo.com --app-password xxx — works
  • yoy auth status — shows app password method
  • After merge, delete YOY_CLIENT_ID and YOY_CLIENT_SECRET GitHub Secrets

🤖 Generated with Claude Code

Yahoo no longer grants mail-r/mail-w API permissions to new developer
apps, making the OAuth2 flow non-functional for IMAP/SMTP access.
This removes all OAuth2 code and simplifies to app-password-only auth,
eliminating the need for GitHub Secrets credential injection and making
the project fully open-source buildable by anyone.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@gumruyanzh gumruyanzh merged commit fedc46e into main Feb 25, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant