# Error: unauthorized_client (Gmail)

Source: https://catalystgroup.gg/docs/email-delivery/error-unauthorized-client/
Updated: 2026-10-19 · By Duane Garner

Google refuses to let this OAuth client use the saved Gmail token. The client changed, was disabled, or is the wrong type.

This article is for sites using the **Google / Gmail** mailer where sending or authorizing fails with `unauthorized_client`.

 

> **The error as you see it:** `unauthorized_client: Unauthorized`
>  
> Shown by the **Google / Gmail** mailer, in the failed-send banner, in **Tools → Debug Events**, or on the settings page right after authorizing.

 

## What this error means

 

Google recognised the request but says this OAuth client is not allowed to do what it asked. With CRM-NG SMTP that almost always means one of two things: the saved refresh token was issued to a *different* client than the Client ID now saved in WordPress, or the client itself is set up in a way Google will not accept for this kind of request.

 

## Common causes

 
- **The credentials were swapped after authorizing.** You pasted a new **Client ID** and **Client Secret** but kept the old connection. The token still belongs to the old client.
- **The OAuth client is the wrong type.** The plugin needs a client of type *Web application*. A *Desktop*, *Android* or *TV* client cannot complete this flow.
- **The OAuth client or project was deleted or disabled** in the Google Cloud Console, or the project was suspended.
- **A Google Workspace admin restricts third-party apps.** If the domain only allows trusted apps, an untrusted client can be refused.
- **Settings imported from another site** brought a token tied to that site's client.

 

## How to fix

 
1. Open your OAuth client
  In the Google Cloud Console (`https://console.cloud.google.com/`) go to **APIs & Services → Credentials** and open the client listed under *OAuth 2.0 Client IDs*.
2. Check its type
  It must say *Web application*. If not, choose **Create credentials → OAuth client ID**, pick *Web application*, and continue with the new client.
3. Add the redirect address
  In WordPress, go to **CRM-NG SMTP → Settings → General** and press **Copy URL to clipboard** next to **Authorized redirect URI**. Paste it into **Authorized redirect URIs** on the Google client and save.
4. Check the project
  Make sure the Gmail API is enabled for this project (**APIs & Services → Enabled APIs & services**) and that the project is not disabled.
5. Check Workspace policy (Workspace only)
  A Workspace admin can open `https://admin.google.com/`, go to **Security → Access and data control → API controls → Manage Third-Party App Access**, and mark your client as *Trusted*, or allow it for the sending user.
6. Save the right credentials
  Back in **CRM-NG SMTP → Settings → General**, use **Remove Client Secret**, paste the **Client ID** and **Client Secret** from the client you just checked, and press **Save Settings**.
7. Reconnect
  Press **Remove OAuth Connection**, then **Allow plugin to send emails using your Google account**, and approve the request.
8. Send a test
  Go to **CRM-NG SMTP → Tools → Email Test** and press **Send Email**.

 

## Verify it worked

 

You see **Connected as** with the sending address, and the test page reports "Test email sent successfully! Check your inbox to confirm delivery." The message arrives in the **Send To** inbox.

 

## Notes

 
- Whenever you change the Client ID or Client Secret, always reconnect afterwards. A token never moves from one client to another.
- After importing settings from another site, the plugin shows the OAuth redirect address with a **Copy** button. Add it to your Google client before you reconnect.

 

## Related

 
- [Google Workspace / Gmail](https://catalystgroup.gg/docs/email-delivery/mailer-gmail/)
- [Error: invalid_grant: bad request (Gmail)](https://catalystgroup.gg/docs/email-delivery/error-invalid-grant-bad-request/)
- [Importing settings from another mail plugin](https://catalystgroup.gg/docs/email-delivery/import-from-wp-mail-smtp/)
- [Troubleshooting email delivery](https://catalystgroup.gg/docs/email-delivery/troubleshooting/)