Gmail API vs Zoho Mail API

Gmail API

Fourteen OAuth scopes separate labels, sending, metadata and read-only access, and the quota page gives every method a unit cost. Eight of the scopes are restricted, read-only and metadata among them, so a public app that reads mail needs Google's verification and an annual third-party security assessment. Gmail mailboxes only.

Zoho Mail API

A REST API over a Zoho Mail mailbox with OAuth scopes that narrow to one resource and one operation, plus an MCP server launched in 2026. Zoho publishes no OpenAPI file, SDK, request rate limit or API changelog, and its usage policy bars automated email.

Gmail API

1. Ask for the narrowest scope. gmail.labels is non-sensitive and gmail.send is sensitive, while every scope that reads mail is restricted
2. List with messages.list and q in Gmail search syntax, then fetch each ID with format=metadata or full. List calls return IDs only
3. Send by posting an RFC 2822 message, base64url encoded, in raw. Set threadId and matching reply headers to stay in a thread
4. Store the historyId and call history.list. On a 404, run a full sync. Call watch again at least every 7 days
5. Back off exponentially on 403 and 429 rate errors, and keep batches to 50 requests or fewer

Zoho Mail API

1. Send Authorization: Zoho-oauthtoken <token>, not Bearer. The token response says Bearer, but the OAuth guide says the Mail API requires the Zoho prefix.
2. Use the host for the account's data centre, such as mail.zoho.eu or mail.zoho.in. Call GET /api/accounts first for the accountId every mailbox call needs.
3. Reading a message body needs both folderId and messageId. List and search calls return a summary only, 10 messages by default and 200 at most.
4. Request ZohoMail.messages.READ alone for a reading agent. Add CREATE only when it must send, and leave DELETE out unless required.
5. Refresh the access token every hour, and post OAuth parameters in the request body where the server accepts it, to keep secrets out of URLs.