“Invalid Credentials” in Apple Mail

Apple Mail (macOS and iOS) can suddenly display an alert stating “Invalid Credentials,” flag an account with a lightning bolt or exclamation point icon, or present a persistent notification claiming the password could not be verified.

Quick Answer

In Apple Mail, “Invalid Credentials” typically indicates that macOS or iOS has cached an expired OAuth2 session token, macOS Keychain has an entry mismatch, or the account is attempting to use Basic Authentication instead of Modern Web Sign-In. To fix it, delete the account from macOS System Settings (Internet Accounts) and re-add it as a direct “Google” or “Microsoft Exchange” profile.

---

What the Signal Means

Apple Mail uses Apple’s native system identity container (Internet Accounts) to handle mail, contacts, and calendars. When configuring providers like Gmail, Yahoo, or Microsoft 365, Apple Mail handles logins through a secure browser window (OAuth 2.0 Web Authentication) rather than storing plain text passwords.

An “Invalid Credentials” error means the underlying mail transport layer (IMAP, Exchange Web Services, or SMTP) attempted to authenticate against the server using a token that the mail server outright rejected.

---

Technical Causes

Apple Mail "Invalid Credentials"
│
├── Did you recently change your account password via the web?
│   ├── YES ──► Broken OAuth token refresh. Remove & re-add the profile.
│   └── NO  ──► Keychain lockup or application-specific password requirement.
│
├── Was this account added as "Other Mail Account"?
│   ├── YES ──► Manual IMAP/SMTP setup. Google/Microsoft blocks legacy auth.
│   └── NO  ──► Internet Accounts cache desynchronization.

1. Legacy IMAP Setup (“Other Mail Account”): If an account was manually configured as an IMAP profile rather than selecting the designated provider logo (“Google” or “Microsoft Exchange”), Apple Mail attempts to authenticate using legacy password protocols that major mail hosts now block.
2. Stale Safari/WebKit Auth Cookies: macOS handles native modern authentication within WebKit containers. If old session cookies or authentication tokens expire without refreshing cleanly, Apple Mail fails silently in the background.
3. Corrupt macOS Keychain Records: If a Keychain entry becomes write-protected or contains duplicate references for the same server (e.g., imap.gmail.com), Apple Mail pulls outdated session information rather than the current token.
4. Token Revocation from Security Events: If an admin enforces a device compliance action, requires an MFA reset, or changes an Organizational Unit policy, the external provider revokes the refresh token.

---

Step-by-Step Resolution

Step 1: Re-authenticate through System Settings (Not Apple Mail)

Do not try to fix the password inside the Apple Mail app preferences. Apple Mail delegates token handling to the operating system:

On macOS (Ventura, Sonoma, Sequoia):

1. Open the Apple menu () > System Settings.
2. Click Internet Accounts in the sidebar.
3. Locate the affected account. If it says “Update settings” or displays a warning, click it.
4. Click Sign In or Re-enter Password.
5. Complete the browser-based login and secondary two-factor verification.

On iOS / iPadOS:

1. Open Settings > Mail > Accounts.
2. Select the malfunctioning account.
3. Tap Re-enter Password and complete authentication in the web frame.

---

Step 2: Delete and Re-Add the Account (Clean OAuth Binding)

If re-authenticating fails or the dialog box doesn’t appear, clear the account configuration entirely. (Note: This does not delete any mail stored on the remote server; it only purges local cached synchronization data).

1. In System Settings > Internet Accounts, select the troubled account.
2. Click Delete Account at the bottom of the pane.
3. Restart your Mac.
4. Return to System Settings > Internet Accounts.
5. Click Add Account.
6. Crucial: Click Google or Microsoft Exchange. Do not select “Add Other Account” and do not configure manual IMAP settings.
7. Authenticate via the secure browser window to establish a fresh OAuth2 refresh token.
8. Re-enable Mail and close System Settings.

---

Step 3: Clear Stale Keys from macOS Keychain Access

If Apple Mail immediately reverts to “Invalid Credentials” after re-adding the account, your Keychain may be locked or corrupted:

1. Open Keychain Access via Spotlight (Cmd + Space, type Keychain Access).
2. In the sidebar, select the login keychain, then select the Passwords category.
3. In the search box in the top-right corner, enter your email address.
4. Select and delete any keys associated with that email address (e.g., Apple.InternetAccounts, com.apple.account.Exchange, or com.apple.account.Google).
5. Search for imap.gmail.com or your company’s mail host and delete those entries as well.
6. Restart the Mac and re-open Apple Mail. You will receive a clean prompt to sign in.

---

Step 4: Verify App-Specific Passwords (For Custom Domains/Legacy IMAP)

If you intentionally maintain a manual IMAP/SMTP setup on an account protected by 2-Step Verification:

• You cannot use your standard password.
• You must generate a dedicated 16-character App Password through your account provider’s security portal.
• Paste this password into both the Incoming Mail Server (IMAP) and Outgoing Mail Server (SMTP) account settings in Apple Mail.

If your mail provider is Google Workspace and basic authentication prompts continue to fail across your Mac fleet, review Resolving “App Passwords” Not Working to ensure app passwords have not been disabled at the tenant level.