FairEmail developer struggles with Google’s limit for OAuth tokens

0
49
fairemail developer struggles with googles limit for oauth tokens.jpg
fairemail developer struggles with googles limit for oauth tokens.jpg

The FairEmail app was recently removed from the Google Play Store and added back several times. The reason for this is Google’s limit for new users of an app.

The open source mail client FairEmail is currently frequently removed from the Google Play Store and later added back. The reason for this is a limit that Google sets for new users of an app, according to the FairEmail status website. The OAuth tokens for authorizing new users are limited. OAuth is a protocol for the authorization of programming interfaces (API), the acronym stands for Open Authorization.

 

On July 20, developer Marcel Bokhorst wrote about the problems with the OAuth tokens on the FairEmail status page for the first time. He had to remove the app from the Play Store because it exceeded the limit of the OAuth tokens granted. This means that no new Gmail accounts can be created via FairEmail. Bokhorst has requested that the limit for his app be increased – but it could take days for Google to respond. The last time he had the limit raised was just over a year ago.

In the last few days, FairEmail’s token rate has apparently fluctuated greatly: sometimes it fell below the limit and the app was added to the Play Store, then the rate exceeded the limit and the app disappeared from the store. Currently (as of July 28, 2022) the token rate is stable below the limit and the app is therefore normally available, according to the status page.

According to Bokhorst, he did not receive any helpful and sometimes only standardized answers from Google when he applied to increase the limit. He thinks that Google is violating EU law with its token limit. The group abuses its market power to keep apps that compete with Gmail small; Gmail itself has no token limit. In response to the standardized answers, Bokhorst has therefore lodged a complaint with the EU.

Google itself explains on a support page that the limitation of OAuth tokens in applications that use OAuth and Google Identity is to protect against misuse. This affects both the users and the systems of Google. Both the rate of newly authorized users and the number of new users would be limited. If an app exceeds the limit, users would get the error message “403: rate_limit_exceeded”.

To prevent the confusing error message, Google encourages app developers to keep an eye on the token rate in order to request a limit increase in good time. Google reserves the right to take up to five business days to respond to such a request. Google does not explain how a developer should know and predict when an app will exceed the limit.

The FairEmail app had already been removed from the Google Play Store in May. At that time, Marcel Bokhorst was so frustrated with the communication with Google that he temporarily wanted to give up his app project altogether. Ultimately, he was able to solve the problems complained about by Google and the app was added to the Play Store again.