Several years ago I had an idea for a CRM for freelancers and I started building a web app with Bubble. One core feature was the ability to group emails by project based on sender and recipient.

It didn't take me long to discover a rather expensive obstacle in the form of a mandatory security assessment, which in Google's words, will cost between $15,000 and $75,000 to complete.

Full details: https://support.google.com/cloud/answer/9110914?hl=en

You can develop and test without completing the assessment but it's required for a production app.

I then discovered Nylas. They provide support for developers, as part of their service, to help keep this fee at the bottom of the price range of $15,000.

Still too much for me as a bootstrapping indie Bubble developer. Whilst I'm pleased Google places special scrutiny on apps that access emails I must admit to feeling very disappointed.

Until I recognised this workaround.

Helpscout is an immensely popular help desk and support app. They don't require users to share their emails using the Google Email API, in fact, users aren't restricted to just Google/Gmail based emails. Helpscout demonstrates a model of sending and receiving emails without requiring API authentication.

Inbound emails are forwarded from the users' email hosting provider to a unique Helpscout address. Checkout Postmark for more about handling inbound emails - https://postmarkapp.com/inbound-email

Outbound emails are authenticated using a combination of DNS records on the domain level. From a user's perspective emails originate from the domain name just like a regular email client.

This can also be done with Postmark: https://postmarkapp.com/transactional-email