Gmail MCP keeps asking you to sign in again? The fix
Why a Gmail MCP server for Claude or Cursor logs you out every week or every hour, and how to make the sign-in stick, from Google's own rules.
By Emmett Miller
A Gmail MCP server that asks you to sign in again every week is almost always running on a Google Cloud project in Testing. Google gives a Testing project sign-ins that expire 7 days after you approve them. Publish the project in the Google Cloud console and sign in once more, and the sign-in stops expiring. If it asks every hour instead, the server isn't renewing its access, and an update to the server is the fix.
These causes come from Google's OAuth documentation as of November 2026. Each section below starts with a symptom, so you can jump to the one you see.
It asks every 7 days: your Google Cloud project is in Testing
Self-hosted Gmail MCP servers, such as the GitHub projects most guides point to, make you create your own Google Cloud project and OAuth consent screen. New projects start in Testing. Google's rule: a project with an external user type and a publishing status of "Testing" "is issued a refresh token expiring in 7 days, unless the only OAuth scopes requested are a subset of name, email address, and user profile" (Google). Reading Gmail needs more than that, so the server's sign-in dies a week after you grant it.
Google's help page says the same thing from the other side: "Authorizations by a test user will expire seven days from the time of consent," and the refresh token expires with it (Google). One Gmail MCP project's issue calls it "the 7-day refresh-token treadmill" (GitHub).
How to fix it
- Open the Google Cloud console and pick the project your MCP server uses.
- Go to Google Auth Platform, then Audience.
- Under Publishing status, click Publish app.
- Sign in to the MCP server once more, so it gets a sign-in issued after publishing.
Once you click Publish app, the project is "In production" and any Google account can sign in to it (Google).
What publishing costs you
Gmail's scopes are sensitive or restricted, and an unpublished project never had to face that. Once published and not verified, "Google will display an Unverified apps warning message" when you sign in (Google), and the app is "limited to 100 new users until it is verified" (Google). For a server only you use, that means clicking past a warning screen when you sign in.
It asks every hour: the server isn't renewing its access
Google's sign-in gives a server two things: a short-lived access token for calls to Gmail, and a refresh token to get new access tokens. A server that doesn't use the refresh token works until the first access token runs out, then asks you to sign in again.
This is a known bug in some popular servers. One Google Workspace MCP issue says "the server does not use the stored refresh_token to silently refresh expired access tokens" (GitHub). In another, "Every tool call after access token expiry returns ACTION REQUIRED: Google Authentication Needed" (GitHub). Update the server to its latest release, and check its issues for your exact message before you change your Google setup.
It stopped after you changed your password, or on a second computer
Google lists the other reasons a refresh token stops working (Google):
- You changed your Google password. A refresh token with Gmail scopes stops working when "The user changed passwords." Sign in to the server again.
- You signed in on many machines. Google allows "100 refresh tokens per Google Account per OAuth 2.0 client ID," and past that "creating a new refresh token automatically invalidates the oldest refresh token without warning." Running the same project's server on several computers, and signing in again and again, eats into this.
- You didn't use it for six months. A refresh token that "has not been used for six months" expires.
- You removed the app's access in your Google account, or a Google Workspace admin restricted Gmail access for apps.
Alrighty: Gmail for Claude with no Google Cloud project
Alrighty is a mail app for Mac, Windows and Linux with an MCP server built in, so it skips the Google Cloud project entirely. You add Gmail in the app with Sign in with Google, through Alrighty's own published Google app, so there's no Testing status and no 7-day expiry to manage. You can also add Gmail with an app password, which Google gives only to accounts with 2-Step Verification and revokes when you change your Google password (Google).
Click your avatar, choose Connect AI, then Turn on and Add to Claude. Claude's desktop app and Claude Code can then search and read Gmail next to your iCloud and Outlook accounts. The setup guide covers ChatGPT's desktop app, Codex and Cursor too. To do work, Claude opens Alrighty in a window of its own while you watch, and nothing sends until you click Send. Your Google sign-in stays on your computer, encrypted with a key from your system's keychain, and no assistant ever gets it.
Alrighty reads mail only, not Calendar or Drive. It starts with a 14-day trial with no card, then a Free plan or Pro. Download it here. For the self-hosted servers and Google's own options, see our Gmail MCP server guide.
Questions
Why does my Gmail MCP keep logging out?
Every 7 days, it's a Google Cloud project in Testing, and publishing the app fixes it. Every hour, the server isn't using its refresh token, and updating the server fixes it. After a password change, Google cancels sign-ins that have Gmail access, so sign in again.
Do I need Google to verify my app to stop the 7-day expiry?
No. Publishing the app ends the 7-day expiry. Without verification you see an unverified app warning when you sign in, and the app is capped at 100 new users, which doesn't matter for a server only you use.
Why does Claude's own Gmail connector not have this problem?
Claude's Gmail connector signs in through Anthropic's own Google app, so you never create a Cloud project or touch Testing status. The trade-off is what it can do: our Gmail MCP server guide compares its tools with the self-hosted servers.
Can I use an app password with a Gmail MCP server?
Only with a server that signs in over IMAP, not one built on the Gmail API. Google requires 2-Step Verification for app passwords and revokes them when you change your Google password. Alrighty accepts a Gmail app password as well as Sign in with Google.