Google has decided to lift the lid on its Gmail service, allowing every man and his dog to write apps that can access your inbox, so long as you agree to let them in.

Hailed as a replacement for IMAP (Internet Message Access Protocol) by some observers, the new Gmail API probably won’t achieve that distinction for some time, but it does offer some interesting opportunities for developers. According to Google, which outlined the new API at Google I/O yesterday, the release of the spec is a first step in transforming Gmail into a kind of goodie bag for devs who wish to leverage the content of your emails to build better apps. For example, a travel app might scan Gmail for booking confirmations and use these to build an itinerary for you. Alternatively, a finance app might dig into your inbox looking for receipts and file them into a budget plan.

Tapping into email contents isn’t a new idea. Some apps already do so if users allow them to. What’s different is that Google has built a new API to replace IMAP, a ubiquitous but dated and inefficient way to tap into email services. IMAP is complex and doesn’t work well with modern web communication tools such HTTP, and that limits the functionality of apps that work with Gmail, says Google.

“IMAP wasn’t really designed to do all of the cool things that [developers at Google IO] have been working on,” Google’s Eric DeFriez explains in a blog post.

The API makes it easy for devs to send HTTPS calls to a user’s Gmail inbox so they can receive JSON, XML of Google Protobuf responses without the need for a TCP socket. According to Google, this makes the API accessible from numerous cloud environments that don’t support IMAP.

Privacy concerns

This all sounds great for developers, but privacy advocates may have issues. While the API doesn’t touch everything, it’s far more comprehensive than IMAP. Upon being granted access to a mailbox (and who really reads those permissions, anyway?), an app will be able to create or delete messages, and even insert messages into the inbox without the interim step of sending them from another email address. That latest feature is similar to what Google now does with Gmail inbox ads.

The idea of third-parties helping themselves to the content of people’s inboxes could scare off developers enough to limit the Gmail API’s potential, but Google is betting that most users won’t care or notice. It says permissions will address that problem. it’s concerned about privacy of course, and that’s why the API provides different levels of permissions. “If your app only needs to send mail on behalf of a user and does not need to read mail, you can limit your permission request to send-only,” wrote DeFriez.

There are four permission classes for apps, according to Google’s documentation:

1. Request full access to the target account;
2. Request access for everything except the ability to delete messages or threads;
3. Read access, but no write or delete rights; or
4. Access only to create and send messages and their associated drafts.

“Your app should use the most restrictive scope that meets its requirements,” the documentation says, but in a world where even basic wallpaper apps seem to demand nearly full device control, it’s questionable whether developers will obey.

photo credit: Truthout.org via photopin cc