Messaging #

Reserved for administrators

Suppliers #

Settings → Mail configures custom SMTP/SMTP2GO, Google Workspace via Gmail API or Microsoft 365 via Graph. Fields include sender, reply, server, port, encryption, identifier, and OAuth parameters.

Configuration #

For OAuth, enter Client ID and secret, declare the displayed callback URI then connect the account. APP_URL must be the exact HTTPS origin. Enable the configuration for notifications and use the test form.

Security and troubleshooting #

Passwords, secrets and tokens are encrypted with libsodium and do not return to the API. If this fails, check the Messenger worker, gmail.send or Mail.Send rights, and Mailpit locally.

Choose and configure #

Supplier	Main fields
SMTP	server, port, encryption, username, password, sender
Google Workspace	Client ID, OAuth secret, sender and connected account
Microsoft 365	Client ID, tenant, OAuth secret, sender and connected account

For SMTP, prefer STARTTLS/TLS and a dedicated account. For OAuth, create a web application, limit sending permissions, copy the callback URI exactly, save then connect the account.

Test and diagnose #

Activate the configuration only after a successful test to a controlled address. If failed, check active configuration, worker, logs, provider permissions, token expiration and junk folder. In development, check Mailpit on 8025.

Rotation #

A secret value is not redisplayed. After suspecting a leak, revoke it from the provider, replace it in RiskPilot and run a new test.