Google refuses to let this OAuth client use the saved Gmail token. The client changed, was disabled, or is the wrong type.

This article is for sites using the Google / Gmail mailer where sending or authorizing fails with unauthorized_client.

What this error means

Google recognised the request but says this OAuth client is not allowed to do what it asked. With CRM-NG SMTP that almost always means one of two things: the saved refresh token was issued to a different client than the Client ID now saved in WordPress, or the client itself is set up in a way Google will not accept for this kind of request.

Common causes

• The credentials were swapped after authorizing. You pasted a new Client ID and Client Secret but kept the old connection. The token still belongs to the old client.
• The OAuth client is the wrong type. The plugin needs a client of type Web application. A Desktop, Android or TV client cannot complete this flow.
• The OAuth client or project was deleted or disabled in the Google Cloud Console, or the project was suspended.
• A Google Workspace admin restricts third-party apps. If the domain only allows trusted apps, an untrusted client can be refused.
• Settings imported from another site brought a token tied to that site's client.

How to fix

1. Open your OAuth client

   In the Google Cloud Console (https://console.cloud.google.com/) go to APIs & Services → Credentials and open the client listed under OAuth 2.0 Client IDs.

2. Check its type

   It must say Web application. If not, choose Create credentials → OAuth client ID, pick Web application, and continue with the new client.

3. Add the redirect address

   In WordPress, go to CRM-NG SMTP → Settings → General and press Copy URL to clipboard next to Authorized redirect URI. Paste it into Authorized redirect URIs on the Google client and save.

4. Check the project

   Make sure the Gmail API is enabled for this project (APIs & Services → Enabled APIs & services) and that the project is not disabled.

5. Check Workspace policy (Workspace only)

   A Workspace admin can open https://admin.google.com/, go to Security → Access and data control → API controls → Manage Third-Party App Access, and mark your client as Trusted, or allow it for the sending user.

6. Save the right credentials

   Back in CRM-NG SMTP → Settings → General, use Remove Client Secret, paste the Client ID and Client Secret from the client you just checked, and press Save Settings.

7. Reconnect

   Press Remove OAuth Connection, then Allow plugin to send emails using your Google account, and approve the request.

8. Send a test

   Go to CRM-NG SMTP → Tools → Email Test and press Send Email.

Verify it worked

You see Connected as with the sending address, and the test page reports "Test email sent successfully! Check your inbox to confirm delivery." The message arrives in the Send To inbox.

Notes

• Whenever you change the Client ID or Client Secret, always reconnect afterwards. A token never moves from one client to another.
• After importing settings from another site, the plugin shows the OAuth redirect address with a Copy button. Add it to your Google client before you reconnect.

Related

• Google Workspace / Gmail
• Error: invalid_grant: bad request (Gmail)
• Importing settings from another mail plugin
• Troubleshooting email delivery