OAuth-capable mail services can accept access tokens through SASL mechanisms instead of an application’s stored mailbox password.
The token is issued by an identity platform and carries authorization context such as audience, scope and lifetime.
Operations still matter
OAuth moves the problem; it does not remove it. Applications still need secure client credentials or another token-acquisition method, token caching, renewal, least privilege and a way to revoke access.
Provider implementation details differ, so use the provider’s current OAuth documentation for configuration.