Navigation
ELOWEN · Documentation

Last updated: October 27, 2026

Browse documentation · Set up email for your organization

Set up email for your organization

The Email plugin gives people their own mailboxes inside Chetty: they connect a mailbox themselves, choose how much the assistant may do with it and answer mail there. This page is for the administrator. The user side is described in Read and answer your email.

Email is in an unreleased integration. Mailbox connections, tools, alerts and the mail page are written, but the coordinated release verification is still pending; do not enable it for people before it is published.

Google sign-in

Sign-in with Google lets people connect a Gmail or Google Workspace mailbox without an app password.

  1. Create a Google Cloud project and enable the Gmail API.
  2. Configure the OAuth consent screen. For an internal Google Workspace deployment choose an Internal audience in the organization's project. External use of the full mail scope may require Google verification; an internal setup is not an approval for public distribution.
  3. Create an OAuth client of type Web application and add the exact redirect URI: the instance's canonical public URL plus /p/email/oauth/callback.
  4. Request the scope https://mail.google.com/ with offline access.
  5. Enter Google OAuth client ID and Google OAuth client secret under Settings → Access for Email.

Both fields are optional together; without them Gmail uses an app password. Never put the client secret into browser code or documentation. See Google's IMAP OAuth documentation for details.

Microsoft sign-in

Microsoft mailboxes use the Microsoft Teams Entra application.

  1. Add a Web redirect URI: the same canonical public URL plus /p/msteams/mail/callback.
  2. Add the delegated Microsoft Graph permissions User.Read, Mail.ReadWrite, Mail.Send and MailboxSettings.ReadWrite.
  3. Have the tenant administrator grant consent. The sign-in flow also requests offline_access.
  4. Configure the Teams plugin's application ID, application secret and tenant ID through its Access settings.

The mail identity control of the Teams plugin owns the sign-in and refresh tokens; Email receives only a mail-scoped client. The approved first release is single-tenant: personal Outlook.com accounts and other tenants are not supported. After consent, each existing Microsoft mailbox must be reconnected once in Email; reconnecting preserves its mailbox reference, access level, alert settings and polling position. Refreshing an old token does not grant the new permission.

App passwords

When Google sign-in is not configured, people connect Gmail with an app password. Tell them to enable 2-Step Verification and create a separate Google app password; organization policy or Advanced Protection may forbid app passwords. Changing the Google account password revokes them.

For Seznam with two-step verification, the separate password for mail programs from the account's security settings is the one to use, not the one-time sign-in code. A password must never be pasted into a conversation; it belongs only in the account connection form.

Operations

  • Grant the plugin only to accounts that should connect mailboxes. Each person still signs in to their own mailbox and chooses read-only, drafts or sending access.
  • The assistant confirms every send. When no interactive confirmation is possible, such as in a scheduled task, it saves a draft and raises an alert instead.
  • Back up the database together with the host-managed vault key through the established instance backup process. Do not export decrypted credentials for diagnostics.
  • When a mail service refuses a connection, reconnect the affected mailbox instead of changing another person's credentials. Replacement credentials are verified before the existing connection changes.
  • Deleting an account removes the plugin rows and the user's vault entries, not the mail on the provider.