Connect and warm up existing mailboxes

Use this guide when the mailboxes already exist outside OXYGEN. They may be pasted directly or imported from any authorized CSV, JSON, JSONL, or XLSX export. The source vendor is provenance only; it does not change the Google or Microsoft authorization model.

One OXYGEN journey, two independent authorizations. First authorize the exact mailbox for OXYGEN Sequences. Then satisfy the separate OXYGEN Warm-up connection. Importing an address alone does neither, and warm-up never starts recurring billing without an approved quote.

End-to-end workflow

1. Open Accounts → Email → Add inboxes.
2. Choose Connect existing to paste exact addresses, or Import a file for an authorized provider export.
3. Review the provider, tenant, and mailbox counts before registration.
4. Authorize native OXYGEN sending using the Google or Microsoft method below.
5. Complete the separate OXYGEN Warm-up prerequisite for every selected mailbox.
6. Review the exact mailbox scope, ramp, recurring price, and current-cycle credit ceiling.
7. Approve that plan or continue without warm-up.
8. Confirm sending authorization and warm-up status in OXYGEN.

OXYGEN never scans a domain or imports a Google Workspace or Entra directory. Only explicitly submitted addresses can enter the sending pool.

Choose the authorization path

The important Microsoft distinction is that tenant authorization can replace individual mailbox sign-ins for native OXYGEN sending, but it does not replace per-mailbox OXYGEN Warm-up consent for imported, manual, or other mailboxes outside an approved OXYGEN managed-mailbox order.

Add the exact mailbox identities

Connect existing

Paste up to 500 exact Google or Microsoft addresses into Connect existing. Choose the actual hosting provider; Microsoft Azure/Entra mailboxes still use Microsoft transport. OXYGEN registers only those addresses and shows the provider-specific authorization review.

Import a file from any source

The browser and CLI accept CSV, JSON, JSONL, and XLSX files up to 500 rows and 5 MB. The source label is optional provenance, not a connection mode.

Useful fields are:

Microsoft passwords, OAuth tokens, authorization codes, MFA/TOTP seeds, client secrets, service-account keys, and delegation keys are rejected. Never paste a mailbox credential into chat or pass it through MCP. A Google app password may enter only through the signed-in browser import or local CLI credential-file path, where it is encrypted immediately and never returned.

Authorize native OXYGEN sending

Native authorization lets OXYGEN Sequences send and read replies. It does not start warm-up and cannot be inherited from the mailbox's source application.

Google Workspace

Each Google mailbox completes its own Google OAuth sign-in. The returned grant is bound to that exact Google account and OXYGEN workspace.

Microsoft: dedicated sending tenant

Choose Tenant connection · one admin when the selected mailboxes belong to a dedicated Microsoft sending tenant.

• OXYGEN groups the exact submitted addresses by resolved Entra tenant.
• One administrator opens one authorization link for each resolved tenant.
• Microsoft grants application access at tenant level.
• OXYGEN then performs read-only Graph probes for only the submitted addresses and enables only those that pass.
• No directory is listed, discovered, or imported.
• A missing, inaccessible, or wrong-tenant address remains Needs connection.

The provider grant is tenant-wide. OXYGEN enforces the selected-address boundary at verification and every send. A customer that also wants Microsoft itself to enforce a narrower boundary can configure Exchange Application RBAC separately.

One Entra tenant authorization never covers a different Entra tenant. A mixed selection produces one administrator step per resolved tenant.

Microsoft: ordinary company or personal mailbox

Choose Individual sign-in · one per mailbox for ordinary company tenants or personal Microsoft accounts. Each mailbox owner signs in separately. An individual run is capped at 10 links so its consent and retry scope stays reviewable; this is a batch limit, not a workspace limit.

An Entra administrator may still need to approve delegated permissions under the organization's policy, but that prerequisite does not replace each mailbox-owner sign-in in individual mode.

Mailboxes purchased through OXYGEN

OXYGEN normally authorizes the native sending connection unattended after the sending domain's approval lands. Use the status and remedy shown in Accounts:

• Waiting on approval needs no mailbox-owner action; OXYGEN keeps checking.
• Authorize now lets a workspace administrator retry the unattended path.
• Connect or Not sending means automatic authorization cannot finish; each affected mailbox owner completes the OXYGEN browser authorization shown.

Do not obtain or paste a managed mailbox password. This native-send status does not change the managed OXYGEN Warm-up path below.

Set up OXYGEN Warm-up

Warm-up is a separate destination connection because the native Google or Microsoft sending grant cannot be transferred to the managed warm-up service. The customer stays inside the OXYGEN journey and does not need to create or manage a separate warm-up-provider account.

Google Workspace

• A compatible imported Google app password can normally continue into warm-up without a second Google browser login.
• An identity-only Google import can complete native sending, but warm-up stays credential_required until someone who controls that exact mailbox enables Google 2-Step Verification, creates an app password, and re-imports it through the secure credential path.
• OXYGEN never converts its Google OAuth refresh token into a warm-up password.

Microsoft 365 and Entra

Every eligible Microsoft mailbox outside an approved OXYGEN managed-mailbox order completes one OXYGEN Warm-up Outlook authorization. This remains true even when one Entra administrator authorized the whole selected set for native OXYGEN sending.

There is currently no tenant-wide shortcut for this warm-up step. One mailbox's Outlook consent cannot authorize another mailbox. Microsoft passwords and app passwords are never accepted as a fallback.

Managed mailboxes

An OXYGEN managed-mailbox order can activate warm-up automatically after provisioning only when the approved quote explicitly contains the exact future addresses, warm-up ramp, recurring price, credit ceiling, and automatic_after_provisioning=true. That order approval is authority for its own scope only. Otherwise the mailbox uses the standalone warm-up preview.

Review price before activation

For existing or imported mailboxes, the first Enable OXYGEN Warm-up action is a zero-credit, no-provider-write preview. It returns:

• eligible and blocked addresses;
• the proposed ramp, normally four weeks;
• the live recurring price, currently 3,000 credits per warming mailbox-month;
• the maximum current-cycle credit charge; and
• a plan hash bound to the exact scope, credential revision, ramp, and price.

Only a matching approved action may create the warm-up connection, reserve or capture credits, and start the ramp. If any bound input changes, OXYGEN returns plan_stale and requires a fresh review. The operator may explicitly continue without warm-up.

CLI equivalent

Use the web journey for ordinary onboarding. Operators can inspect the same contract through the CLI.

Validate a provider-neutral identity export locally:

oxygen mailboxes import --file ./mailboxes.csv \
  --vendor provider-export --validate-only --json

Inspect the registered mailboxes:

oxygen mailboxes compatibility --json
oxygen mailboxes oauth-health --json

Preview a Google mailbox's native authorization:

oxygen mailboxes connect-oauth --vendor oxygen --provider google \
  --mailboxes sender1@example.com --json

Preview native authorization for a dedicated Microsoft sending tenant:

oxygen mailboxes connect-oauth --vendor oxygen --provider microsoft \
  --authorization-mode tenant \
  --mailboxes sender1@example.com,sender2@example.com --json

Use --authorization-mode individual for ordinary company or personal Microsoft mailboxes:

oxygen mailboxes connect-oauth --vendor oxygen --provider microsoft \
  --authorization-mode individual \
  --mailboxes sender1@example.com --json

Google always uses individual OAuth.

For a Microsoft mailbox outside an approved OXYGEN managed-mailbox order, preview the separate warm-up consent:

oxygen mailboxes warmup microsoft \
  --mailboxes sender1@example.com,sender2@example.com --json

Then preview the priced warm-up plan:

oxygen mailboxes warmup enable \
  --mailboxes sender1@example.com,sender2@example.com \
  --ramp-weeks 4 --json

Do not approve by copying placeholders from documentation. Review the current response, then echo its fresh plan hash and exact credit ceiling into the approved command.

Verify and recover

Never warm the same mailbox on two networks. Cancel any existing source-provider warm-up before approving OXYGEN Warm-up.

Common questions

Does every mailbox connect twice?

There are two authorization contracts, but one guided OXYGEN journey. Google normally uses one native OAuth sign-in plus an app-password handoff. Microsoft ordinary accounts use two browser authorizations per mailbox. A dedicated Entra sending tenant can reduce the native stage to one administrator grant per tenant, while non-managed warm-up still needs one consent per mailbox. Mailboxes purchased through OXYGEN can use managed authorization and warm-up handoffs covered by their approved order; follow the exact Accounts status instead of assuming that a second browser step is required.

Can OXYGEN reuse an OAuth grant from the source vendor?

No. OAuth grants are bound to the application, account, tenant, scopes, and audience that obtained them.

Does tenant mode connect the whole Entra directory?

No. Microsoft grants the application tenant-level access, but OXYGEN registers, probes, and enables only the exact submitted addresses. It never lists or imports other directory users.

Does import automatically start warm-up or billing?

No. Import registers mailbox identities. Existing/imported mailbox warm-up starts only after its prerequisites and exact priced plan are approved. The separate managed-order exception applies only when that order's approved quote explicitly grants automatic activation for its exact addresses.

Who sends outbound campaigns?

OXYGEN Sequences. Warm-up authorization does not create a campaign or grant campaign-dispatch authority.

Related

• Mailbox compatibility reference — the complete origin, hosting, and downstream-authentication matrix.
• Approvals — exact scope, previews, and approval tokens.
• Billing and credits — recurring services and credit ceilings.
• Sequences — sender readiness, enrollment, and dispatch.