Only show these results:

Create grants with Custom authentication

Nylas v3 preserves Native authentication ("Bring your own token") almost unchanged, but renames it "Custom authentication". If you already have a refresh token (or credentials, if using IMAP) for your end users from your own authentication implementation, you can use it with the Nylas APIs to create a grant and get the grant_id, which you then use in requests to the provider.

If you used Native auth in Nylas v2.x, the only changes are to the Nylas API URLs, the requirement that you create a connector (previously called an "integration") for your application, and the change from token authentication to bearer-token authentication.

If you are handling the OAuth flow in your own application or want to migrate existing users, Custom auth allows you to simply provide the user refresh_token to create a grant.

Use API request for Custom authentication

The following examples show a POST /v3/connect/custom request and a sample response.

"provider": "microsoft",
"settings": {
"refresh_token": "1//06lIzwlbg4SgLCgY..."
"request_id": "5967ca40-a2d8-4ee0-a0e0-6f18ace39a90",
"data": {
"id": "e19f8e1a-eb1c-41c0-b6a6-d2e59daf7f47",
"provider": "microsoft",
"grant_status": "valid",
"email": "",
"scope": [
"user_agent": "string",
"ip": "string",
"state": "my-state",
"created_at": 1617817109,
"updated_at": 1617817109

Use Nylas SDKs for Custom authentication

You can use the v3 Nylas SDKs to set up Custom auth, as in the examples below.

# Load your env variables
from dotenv import load_dotenv

# Import your dependencies
import os
import sys
from nylas import Client
from nylas.models.grants import CreateGrantRequest
from nylas.models.auth import Provider

# Initialize your Nylas API client
nylas = Client(

request_body = CreateGrantRequest(
"provider": "<PROVIDER>",
"settings": {"username": "<USERNAME>", "password" : "<PASSWORD>"},
"scope": ["email.read_only", "calendar.read_only", "contacts.read_only"],
"state": "<STATE>"

auth = nylas.auth.custom_authentication(request_body)
# Load gems
require 'dotenv/load'
require 'nylas'

# Initialize Nylas client
nylas =
api_key: "<NYLAS_API_KEY>"

# Request body
request_body = {
provider: '<PROVIDER>',
settings: {'username': '<USERNAME>', 'password': '<PASSWORD>'},
scope: 'email.read_only,calendar.read_only,contacts.read_only',
state: '<STATE>'

# Call Custom Authentication
auth = nylas.auth.custom_authentication(request_body)
puts auth
package org.example;

// Import Nylas Packages
import com.nylas.NylasClient;
import com.nylas.models.*;
// Import Packages
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

public class Main {
public static void main(String[] args) throws
NylasSdkTimeoutError, NylasApiError {
// Initialize the Nylas client
NylasClient nylas = new NylasClient.Builder("<NYLAS_API_KEY>").build();
// Select the provider
AuthProvider provider = AuthProvider.ICLOUD;
// Build out the settings
Map<String, String> settings = new HashMap<String, String>();
// Build our the scopes
List<String> scope = new ArrayList<String>();
// Create the request body
CreateGrantRequest request_body = new CreateGrantRequest(provider,settings, "<SCOPE>", scope);
// Generate the grant
Response<Grant> auth = nylas.auth().customAuthentication(request_body);
package org.example

// Import Nylas Packages
import com.nylas.NylasClient
import com.nylas.models.*

fun main() {

// Initialize Nylas client
val nylas: NylasClient = NylasClient(
apiKey = <"V3_TOKEN_API">
// Select the provider
val provider = AuthProvider.ICLOUD
// Build out the settings
val settings = mapOf<String, String>("username" to <"USERNAME">,
"password" to <"PASSWORD">)
// Build our the scope
val scopes = listOf("email.read_only", "calendar.read_only", "contacts.read_only")
// Create the request body
val requestBody = CreateGrantRequest(provider, settings, "<STATE>", scopes)
val auth = nylas.auth().customAuthentication(requestBody)
// Generate the grant

Creating a Custom auth login page

Nylas provides a login page for Hosted authentication that uses the detect provider API to route user logins to the correct provider.

If you're using Custom authentication instead, you must create a login page for your app where your users enter their login credentials. This should be branded, and can use the Detect Provider endpoint to help route user logins to use the correct Connector.

⚠️ Avoid storing user credentials by making a Custom Authentication request directly from your login page with the user-provided credentials. If you must store the credentials, make sure you do so securely. For more information, see Security best practices.

What's next?

Now that you have created a connector and received a grant, you can do the following tasks: