How to Reset Gmail “OAuth2” Token (Outlook)

When you connect a Gmail or Google Workspace account to Microsoft Outlook, modern authentication uses OAuth 2.0 rather than storing your account password. Instead of keeping your actual credentials on disk, Outlook stores an access token and a refresh token issued by Google.

If that token gets revoked, expires without refreshing cleanly, or becomes corrupted after a password reset, Outlook will get stuck. It may ask you to sign in over and over, display errors like “Cannot connect to server,” or fail to load the Google login window entirely.

Quick Answer

To reset a Gmail OAuth2 token in Outlook, you need to clear the old identity tokens from both sides. First, remove Outlook’s permission under Third-party apps & services in your Google Account Security settings. Next, delete any cached MicrosoftOffice and Google identity entries from the Windows Credential Manager, then restart Outlook to complete a fresh web sign-in.

---

What the Signal Means

When using OAuth2, signing in through the Google browser prompt issues a cryptographic grant to Microsoft apps and services:

[ Outlook Client ] ─── Valid Token ───► [ Google Identity API ] (Access Granted)
[ Outlook Client ] ─── Broken Token ──► [ Google Identity API ] (Immediate 401 Rejection)

• Access Token: A short-lived credential (valid for about an hour) used to authorize ongoing IMAP and SMTP connections.
• Refresh Token: A long-lived credential saved locally in your Windows Credential Manager. It lets Outlook automatically request a new access token in the background without prompting you to log in again.

If a refresh token is revoked on Google’s servers (for example, following a password change, an MFA update, or an admin security policy), Outlook’s local client will not always handle the revocation cleanly. Instead of prompting you to log in again, it may keep trying to authenticate using the old token, resulting in continuous connection failures.

---

Step-by-Step Procedure to Reset the OAuth2 Token

To fix a stuck token, you must clear the connection from both your Google Account and your local Windows system.

Step 1: Revoke Access in Your Google Account

First, tell Google’s servers to invalidate any existing refresh tokens tied to your desktop installation:

1. Open a web browser and sign in to your Google Account Security Settings.
2. Scroll down to the Your connections to third-party apps & services section.
3. Click on See all connections.
4. Look for Microsoft Apps & Services (or Microsoft Outlook).

!Google Account Third-Party Permissions List

1. Click the entry, scroll down, and select Delete all connections that you have with Microsoft Apps & Services.
2. Confirm the prompt by clicking Confirm.

---

Step 2: Clear Cached Tokens from Windows Credential Manager

Next, clear the old tokens from your local Windows profile so Outlook doesn’t try to reuse them:

1. Close Microsoft Outlook completely.
2. Press the Windows Key, type Credential Manager, and press Enter.
3. Select the Windows Credentials tile.
4. Scroll down to the Generic Credentials section.
5. Look through the list and delete any entries related to your Google account or Outlook’s token cache, including:
   • MicrosoftOffice16_Data:OAUTH...
   • MS.Outlook.16:user@domain.com
   • Any credentials mentioning Google or gmail.com.
6. Click the drop-down arrow next to each matching entry and click Remove.

---

Step 3: Clear Edge and WebKit Token Storage

Modern versions of Outlook use the Microsoft Edge WebView2 runtime to display the Google OAuth sign-in box. If WebView2 has cached an old browser session, the prompt might vanish before you can type anything:

1. Press Windows Key + R to open the Run box.
2. Paste the following path and click OK: %localappdata%\Microsoft\Outlook
3. Look for a folder named Offline Address Books or subfolders with names like HubAppFileCache and delete their temporary contents.
4. If your system has an active WebView2 identity cache, open the Run box again and enter: %localappdata%\Microsoft\Edge\User Data\Default
5. Clear out temporary files or old cookies if you are comfortable doing so, or simply proceed to Step 4.

---

Step 4: Complete a Fresh OAuth2 Sign-In

Now you can re-link Outlook to your Google account with a fresh token:

1. Open Microsoft Outlook.
2. A pop-up dialog will appear saying “Outlook needs your password” or display a Sign in with Google prompt.
3. Enter your full Gmail address and click Next.
4. Enter your regular Google account password.
5. Complete your two-factor authentication challenge (e.g., a prompt on your phone or a hardware security key).
6. When prompted with the screen: “Microsoft apps & services wants to access your Google Account”, click Allow.

Once you click Allow, Google generates a new refresh token and sends it back to Outlook. Outlook saves this fresh token into the Windows Credential Manager, restores your IMAP connection, and starts syncing your folders normally.

If the login window still closes immediately or throws a script error, your system-level identity broker may need to be reset. For instructions on repairing that service, see How to Resolve Outlook 365 “Credential Loop”.