Inboxes
Credentials are encrypted before they touch the database and are never returned to the browser. Use an app password wherever two-factor authentication is enabled.
Microsoft 365 / Outlook
One connection covers mail, calendar, and OneDrive board documents. Sign in as the mailbox owner and approve the permission prompt.
Add the two credentials below to enable this.
1
Register the app
Open entra.microsoft.com and go to Applications, then App registrations, then New registration. Give it any name. Under Supported account types choose the option that includes your organization's directory.
2
Add this redirect URI
On the registration, open Authentication, then Add a platform, then Web, and paste the URI below. It must match exactly — no trailing slash.
https://brian.capetivate.app/api/oauth/microsoft/callbackThis URI is specific to the site you are viewing right now. Your production deployment has a different domain, so register that one too when you deploy.3
Grant Graph permissions
Open API permissions, then Add a permission, then Microsoft Graph, then Delegated permissions, and add all of these:
Mail.ReadWriteMail.SendCalendars.ReadFiles.ReadWriteUser.Readoffline_accessThen click Grant admin consent. Most organizations block user-level consent for mail scopes, so skipping this produces a consent error even when everything else is right.4
Copy the two credentials
MICROSOFT_CLIENT_ID is the Application (client) ID on the Overview page.MICROSOFT_CLIENT_SECRET comes from Certificates & secrets, then New client secret. Copy the Value, not the Secret ID — it is only shown once.Add both in Project Settings, then Environment Variables. Set a 24-month expiry on the secret and put a reminder in the calendar, because mail sync stops when it lapses.