Your Microsoft password stays with Microsoft
Authorization uses the Microsoft identity platform with Authorization Code flow, PKCE, state validation, and a confidential application credential. smtpify365 receives OAuth tokens, not the Microsoft password.
Separate credentials per connection
Every connection receives an independently generated SMTP username and password. A connection can be revoked without changing the mailbox password or another device connection.
Tokens encrypted using the SMTP password
Independent encryption and verifier keys are derived from the generated SMTP password and a random salt using scrypt. OAuth tokens are encrypted with AES-256-GCM. The generated password itself is not stored and is only present transiently during SMTP authentication.
Transport rules reduce exposure
Authentication is refused until STARTTLS is active. Only PLAIN and LOGIN are accepted after TLS. The SMTP envelope sender is restricted to the authenticated Microsoft mailbox.
What this page does not claim
This is a description of the implemented design, not a certification, audit report, uptime guarantee, or claim of Microsoft endorsement. Operational details should only be published after they are verified against the deployed service.