Fastmail API (JMAP) vs Gmail API

Fastmail API (JMAP)

A mailbox API built on the open JMAP standard, with read-only tokens, six OAuth scopes and an MCP server that separates read, write and send access. Fastmail publishes no OpenAPI file, SDK, API changelog, request rate limit or SLA, and its customer terms forbid programmatically generated email to addresses outside the account.

Gmail API

Fourteen OAuth scopes separate labels, sending, metadata and read-only access, and the quota page gives every method a unit cost. Eight of the scopes are restricted, read-only and metadata among them, so a public app that reads mail needs Google's verification and an annual third-party security assessment. Gmail mailboxes only.

Fastmail API (JMAP)

1. Fetch https://api.fastmail.com/jmap/session with Authorization: Bearer <token> first. It returns the API URL, account IDs and the request limits to stay under
2. Ask the owner for a read-only token unless the task writes. Sending needs both the Email and Email submission scopes
3. Request only the properties you need. Body text is not returned unless fetchTextBodyValues is set, and maxBodyValueBytes caps it
4. Sync with Email/changes from a stored state. On cannotCalculateChanges, fetch again from scratch
5. Do not send generated mail to outside recipients without the owner's review. The customer terms forbid it, and trial accounts stop at 120 messages a day

Gmail API

1. Ask for the narrowest scope. gmail.labels is non-sensitive and gmail.send is sensitive, while every scope that reads mail is restricted
2. List with messages.list and q in Gmail search syntax, then fetch each ID with format=metadata or full. List calls return IDs only
3. Send by posting an RFC 2822 message, base64url encoded, in raw. Set threadId and matching reply headers to stay in a thread
4. Store the historyId and call history.list. On a 404, run a full sync. Call watch again at least every 7 days
5. Back off exponentially on 403 and 429 rate errors, and keep batches to 50 requests or fewer