innovaphone wiki - User contributions [en]

Reference16r1:Concept myApps platform services

2026-08-23T10:26:49Z

Tmo: /* OS settings for Android */

[[Category:Concept|myApps]]

myApps platform services provide various operating system specific services which can be used by other ''Apps'' running in the [[{{NAMESPACE}}:Concept myApps|myApps client]]. Those services typically are not available in the browser's JavaScript environment and hence must be implemented in native platform code. Therefore, the platform services are installed as native executable on the respective platform.

When myApps is started in a web browser (and hence has no access to the platform services), some Apps will use [https://en.wikipedia.org/wiki/WebRTC WebRTC] services implemented by the browser instead. For ease of reference, features available in this scenario are also described here.

On windows, the platform services also come with their own web browser in which the myApps web App will be started then. This browser is based on google's [https://en.wikipedia.org/wiki/Chromium_(web_browser) Chromium] open source software.
= Applies To =

* [[{{NAMESPACE}}:Concept myApps|myApps]]
* myApps for Windows
* myApps for macOS
* myApps for iOS
* myApps for Android
* myApps Web App (WebRTC)
* myApps for IP270
version 16r1

=Features=
Not all features are available or required on all platforms.
{|
! style="text-align: left; font-weight: bold" | Feature
! style="text-align: left; font-weight: bold" | Description
! style="text-align: left; font-weight: bold"| Availability
|-
| || || Windows || iOS || Android || macOS || Browser<ref>This refers to the myApps web application running in a browser with no platform services available</ref>
|IP270
|-
| [[#Device handling|Audio Devices]]|| manage local audio devices to record and playback audio conversations || ✔ || ✔ || ✔ || ✔ || ✔<ref>audio available but devices managed by web browser</ref>|| ✔
|-
| Video || manage local displays and cameras to capture and render video live stream || ✔ || ✔ || ✔ || ✔ || ✔<ref>video available but devices managed by web browser</ref>|| ✔
|-
| Ringer || manage local ringing device || ✔ || ✔ || ✔ || ✔ || ✔ || ✔
|-
| [[#Application sharing|Application sharing]]
|-
|   presenter || share an application || ✔ || ✗ || ✔ || ✔ || ✔ || ✔
|-
|   consumer || view an application shared by the peer || ✔ || ✔ || ✔ || ✔ || ✔ || ✔
|-
| [[#Hot keys|Hot keys]]|| capture key presses for quick invocation of phone apps (e.g. dial selected number) || ✔ || ✗ || ✗ || ✔ || ✗ || ✗
|-
| [[#URL Handler|tel: and sip: URI handler]]|| intercept clicks on tel: and sip: links in web sites to invoke phone apps || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| [[#User activity|User activity]]|| set presence state according to user activity || ✔ || ✗ || ✗ || ✔ || ✔<ref>limited, see [[#User activity|User activity]] below</ref> || ✔
|-
| Docking || myApps can be docked persistently to the right or left edge of your screens || ✔ || ✗ || ✗ || ✗ || ✗ || ✗
|-
| Multi-windowing || Apps can be launched in separate windows|| ✔ || ✗ || ✗ || ✔ || ✗ || ✗
|-
| [[#Recording|Recording]]|| Calls can be recorded to recording app|| ✔ || ✔ || ✔ || ✔ || ✗ || ✔
|-
| [[#Notifications|Notifications]]|| ||
|-
|   display notifications || display notifications with OS standard mechanism || ✔ || ✔ || ✔ || ✔ || ✔ || ✗
|-
|   push notifications || receive push notifications while myApps is not running || ✗ || ✔ || ✔ || ✔ || ✔<ref>The browser needs to be running in order to receive push notifications.</ref> || ✗
|-
|   chat and apps || display notifications for chat and other apps || ✔ || ✔ || ✔ || ✔ || ✔ || ✗
|-
|   calls || display notifications for incoming calls || ✔ || ✔ || ✔ || ✔ || ✗<ref>Call notifications are only displayed locally while the phone or softphone app is started.</ref> || ✗
|-
| [[#Local phonebook access|Local phonebook]]|| access local phone book || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| [[#Microsoft Office Integration|Office presence provider]]|| maps PBX presence state to Microsoft office presence state || ✔ || ✗ || ✗ || ✗ || ✗ || ✗
|-
| [[#Call an external application for calls|External application start]]|| start arbitrary external applications for calls || ✔ || ✗ || ✗ || ✔ || ✗ || ✗
|-
| [[#App Proxy|App Proxy]]|| a caching proxy that provides app persistence || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| [[#Auto update|Auto update]]|| automatically updates myApps platform services to the same version the PBX has || ✔ || ✔ || ✗ || ✔ || ✔<ref>The then-current web app is always loaded from the PBX upon startup and hence up-to-date by definition</ref> || ✔
|-
| Three party conference || initiate 3-pty-conference using Softphone-App || ✔ || ✔ || ✔ || ✔ || ✗ || ✔
|-
| Exclude VPN || disable use of VPN connections for audio and appsharing || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| Screen lock || myApps screen lock against unauthorised use || ✗ || ✗ || ✗ || ✗ || ✗ || ✔
|}

<references/>

=Requirements=
* innovaphone PBX 16r1 and up

== Hardware ==
Recommended hardware requirements
* Processor: Dual-core 2Ghz or higher
* RAM: 4 Gb

== myApps for Windows ==
* Windows 11 and up
* Windows Server 2016 and later versions

=== 32 & 64 bit Windows ===
* 32 bit Windows: install the myAppsSetup32.msi from the App Store
* 64 bit Windows: install the myAppsSetup.msi from the App Store
** the 64 bit variant still installs into Program Files (x86), as the main myApps.exe is still a 32bit application
** the 64 bit variant just contains an additional 64 bit binary for the outlook search

=== Windows N editions ===

Windows N editions are missing the ''Media Feature Pack'' which is pre installed on other Windows versions.

Please install the pack from [https://www.microsoft.com/en-us/software-download/mediafeaturepack Microsoft (Windows 10 pack)] before you install myApps. The installer will check if the file <code>C:\Windows\SysWOW64\mfplat.dll</code> exist on your system.

Make sure to install the correct pack depending on your Windows version! There are different packs for Windows 10 1703, 1803, 1809 and 32bit or 64bit etc.

NB: Sometimes the myApps installation will not work even though the media pack is already installed. This is because the installer has no read access to check if the package is already installed. If the above-mentioned file exists and the installer asks to install the Windows Media Feature Pack nevertheless, you have to start the myApps install with administrative rights.

=== Terminal Server environments ===

Audio driver was removed if myApps discovers that it is running in a terminal server environment like Citrix.

The audio driver is needed for the Softphone App but the Softphone App should not use an audio driver at the server side because the audio devices are plugged locally and there would be a delay sending and receiving audio data with the server.

If a customer wants to use the Softphone App at the server side he needs to make use of the myApps Plugin for virtual desktops solution:

[[{{NAMESPACE}}:MyApps_Plugin_for_Virtual_Desktops|Reference15r1:MyApps_Plugin_for_Virtual_Desktops]]

== myApps for macOS ==
* macOS 13 or higher

== myApps for iOS ==
* iOS 16 or higher

== myApps for Android ==
* Android 13 or higher.

== myApps for IP270 ==
Exclusively used in IP270.

= Licenses =
* No license needed for myApps platform services

= Overview =
myApps platform services is a native executable that is installed using the standard mechanisms on the respective operating system. It provides various advanced services which can be used by the myApps web client code as well as the Apps running in the myApps context.

Also, on Windows, the platform services come with their own, dedicated browser to run myApps in. This browser is based on [https://en.wikipedia.org/wiki/Chromium_(web_browser) Chromium]. On iOS, macOS and Android, it is based upon native embedded web view facilities (such as WKWebView) instead.
== Components ==

=== RTP service for audio and appsharing ===
The RTP service provides audio and appsharing as a video stream. VoIP RTP endpoints (e.g. for softphones). It supports STUN, TURN, ICE, SRTP, DTLS. Note however that unlike WebRTC, these endpoints do not ''require'' ICE and DTLS. In other words, they can communicate also with non-compliant (i.e. older) VoIP devices.

Note that the available capabilities when not running the myApps platform services depend on the used browser's WebRTC implementation. See your browser documentation for details.

Apps can request RTP channels using the [https://sdk.innovaphone.com/doc/launcher/Media.htm Media Protocol]'s ''AllocChannel'' message.

==== RTP ports ====
{|
| audio || 50000 -> 50099
|-
| video (app sharing) || 50100 -> 50199
|}

The RTP service will enumerate all local interfaces and create local HOST candidates for ICE. There is an option however to disregard VPN interfaces (more precisely such interfaces with type of ''IF_TYPE_PPP'' or ''IF_TYPE_TUNNEL''). This can eliminate quality issues when RTP data is transmitted through TCP based VPN tunnels.

SRFLX and RELAY candidates are obtained using the STUN and TURN server configuration passed by the App (e.g the ''softphone'' App) as part of the ''AllocChannel'' request.
<code>{"mt":"AllocChannel","channel":"81429cba-396d-43de-8a76-ec020ba8796e","iceServers":[{"urls":"turn:myturn.domaincom:4077?transport=udp","username":"turnuser","credential":"pwd","credentialType":"password"},{"urls":"stun:mystun.domain.com:4077"}],"dn":"Foo Bar","type":"RemoteRtp","kind":"video"}</code>

==== Codecs ====
The installed myApps launchers provide codecs that can be used by softphone apps for media streams. When running in a web browser the codecs depend on the browser version and operating system. See the documentation of your browser for details.

The following codecs are supported:
{|
!style="text-align:left;width:200px;"|Codec
!style="width:100px"|Windows-Launcher
!style="width:100px"|Android
!style="width:100px"|iOS
!style="width:100px"|macOS
!style="width:100px"|Firefox (Browser)
!style="width:100px"|Chrome (Browser)
!style="width:100px"|Edge (Browser)
!style="width:100px"|Safari (Browser)
!style="width:100px"|Opera (Browser)
!style="width:100px"|IP270
|-
|style="text-align:left; background-color:lightgray" colspan="11"|Audio
|
|-
|G711A
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|G711u
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|G722
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|G729 (since 15r1sr16/16r1sr4)
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|[https://caniuse.com/#search=Opus OPUS-NB]
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|[https://caniuse.com/#search=Opus OPUS-WB]
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
| colspan="11" style="text-align:left; background-color:lightgray" |Video
|
|-
|[https://caniuse.com/#search=VP8 VP8]
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|-
|[https://caniuse.com/#search=VP9 VP9]
|style="color:green;text-align:center"|✔**
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|-
|[https://caniuse.com/#search=H264 H264]
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|style="text-align:left; background-color:lightgray" colspan="11"|Application Sharing
|
|-
|Share
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|Watch
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔*
|style="color:green;text-align:center"|✔*
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔*
|}

''* small presentation only'' 
''** only for 1:1 calls, not for conferences

==== Video capture ====
The default resolution for video capture is 1920x1080 if available. Otherwise, 1280x720, 640x480, 352x288 or 320x240 will be used. The frame rate is 30 fps if available, otherwise 15 fps. The resulting average bandwidth could reach 1 Mbps.

==== Application sharing ====
Screen content will be transmitted as video stream by the presenter

==== Device handling ====
The RTP service enumerates microphones, loudspeaker, cameras and ringing devices and notifies apps when devices come and go. It is up to the apps using the devices to store preferences.

The RTP service also enables some extended features (such as hook switch or volume control) for supported USB headsets or Bluetooth headsets connected to myApps.
The supported headset-SDKs determine which headset vendors are recommended to be used with the myApps softphone app. 

For this to work, the following vendor specific development kits are integrated in our myApps client. Be aware that the SDK are updated within our Service release :

{| class="wikitable"
|-
! SDK Vendor !! Supported OS !! SDK Version !! innovaphone Service Release
|-
| Jabra|| MacOS || 1.16.4.0 || 14r2sr11
|-
||| Windows || 1.16.4.0 || 15r1sr3
|-
| Epos ''(formerly Sennheiser)'' || MacOS || 12.4.0.5478 || 14r1sr3
|-
||| Windows || n.a. - [[Support:13r3 sr10 MyApps Windows Client - Epos/Sennheiser-Headsets require installed Epos-Connect Software|to be installed separately]]|| 13r3sr10
|-
| Poly ''(formerly Plantronics)'' || MacOS || 3.25.53799.37131 || 13r3sr9
|-
||| Windows || 3.25.53800.37131 || 13r3sr10
|-
| Yealink || MacOS || 3.1.1.23 || 14r2sr1
|-
||| Windows || 3.1.1.23 || 14r2sr2
|}

Notes:
* It is possible to inhibit the start of the Sennheiser SDK (SenncomSDK.exe) using the <code>DISABLEHEADSETS</code> directive of the installer (see [[#MSI Parameters and install options| MSI parameters]] below).

* Starting with V13r3sr10, the Epos-SDK needs to be installed separately using the Epos Connect software to ensure full compatibility between current Epos headset models and native myApps-Windows client. For details [[Support:13r3 sr10 MyApps Windows Client - Epos/Sennheiser-Headsets require installed Epos-Connect Software|refer to this article]].


myApps-IP270 supports use of [[Reference9:Concept USB Headset|USB devices known for innovpahone desk phones]].

==== Ring tones ====
Ring tones can be played. Apps can choose the tone from a pre-defined list of ring tones.

On Windows, custom ring tones can be uploaded as .mp3 files to the <code>ringtones</code> sub-directory of myApps' roaming directory (which usually is in <code>%appdata%\innovaphone\myApps\ringtones</code>).

On Android, custom ring tones can be added to the system via Android settings.

On iOS, custom ring tones can be uploaded as .mp3 files to the <code>Ringtones</code> subdirectory of the myApps file share that is available in iTunes if the iPhone has been connected via USB.

On macOS, custom ring tones can be uploaded as .mp3 files to <code>~/Library/Containers/com.innovaphone.client-macos/Data/Documents/Ringtones</code>.

==== Debugging ====
For extended debugging, turn on the ''Audio'', ''Media'' and ''AppSharing'' traces in myApps.
=== Hot keys ===
On Windows and macOS systems, myApps platform services can listen for hot keys and invoke certain functions. Invocation is done by sending API messages to myApps which passes it to an appropriate API provider (in the cases described here, this will be a ''phone'' or ''softphone'' or ''rcc'' App typically. See [[{{NAMESPACE}}:Concept_myApps#Client_APIs_and_default_apps | Client APIs and default apps]] for more details about this mechanism.

The hot keys can be specified using the ''advanced settings'' user interface (see [[#UI elements| UI elements]] below. Any of the function keys F1 to F11 (optionally combined with up to two modifier keys ''alt'', ''ctrl'', ''shift'' or ''win'') can be chosen for each function. If you do not want to start the call with "Hotkey+Enter" because you would have to wait for the focus, the hotkey can also be pressed twice and the number is dialled directly.

; dial selected number : Initiates a call using the currently selected text as target.

: A ''PrepareCall'' message with the ''text'' argument set to the selected text and the ''adjust'' argument set to <code>true</code> will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].

:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":"mt":"PrepareCall","text":"13","adjust":true}}</code>

; accept call : Accepts a currently alerting call.

: A ''ConnectCall'' message will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].

:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"ConnectCall"}}</code>

; reject/disconnect call : Rejects a currently alerting call or disconnects an active call.

: A ''DisconnectCall'' message will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].

:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"DisconnectCall"}}</code>

=== URL Handler ===

On Windows systems, two URI-handler are installed with the myApps platform services. Windows will call up this URI handler when a user clicks on an appropriate link, for example in a web site.

The handler will the send an API message to myApps which passes it to an appropriate API provider (in the cases described here, this will be a ''phone'' or ''softphone'' or ''rcc'' App typically. See [[{{NAMESPACE}}:Concept_myApps#Client_APIs_and_default_apps | Client APIs and default apps]] for more details about this mechanism.

; tel URI : call a number, e.g. <code>tel:4711</code>

: A ''PrepareCall'' message with the ''num'' argument set to the selected text and the ''adjust'' argument set to <code>true</code> will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].
:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"StartCall","num":"4711","adjust":true}}</code>
; sip URI : call a SIP name, e.g. <code>sip:zkl@innovaphone.com</code>

: A ''PrepareCall'' message with the ''sip'' argument set to the selected text and the ''adjust'' argument set to <code>true</code> will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].
:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"StartCall","sip":"zkl@innovaphone.com","adjust":true}}</code>
; im URI : start chat with SIP name, e.g. <code>im:zkl@innovaphone.com</code>

: A ''StartChat'' message with the ''sip'' argument set to the selected text will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.chat/com.innovaphone.chat.htm ''com.innovaphone.chat'' API].
:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.chat","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"StartChat","sip":"zkl@innovaphone.com"}}</code>

On macOS systems myApps might be made the default application to handle tel URI e.g. <code>tel:4711</code> via Apple FaceTime. Open the "FaceTime" menu "Settings..." and select myApps as "Default for phone calls".

On iOS ''tel'' URIs are always dialed via GSM. Therefore myApps iOS also reacts to URI schemes ''com.innovaphone.tel'', ''com.innovaphone.sip'' and ''com.innovaphone.im'', e.g. <code><nowiki>com.innovaphone.tel:4711</nowiki></code>, <code><nowiki>com.innovaphone.sip:zkl@innovaphone.com</nowiki></code>, <code><nowiki>com.innovaphone.im:zkl@innovaphone.com</nowiki></code>.

=== User activity ===
On Windows and macOS systems, the myApps platform services can monitor user keyboard/mouse activity and change the user's presence state after a certain amount of inactivity. The timeout can be specified using the ''advanced settings'' user interface (see [[#UI elements| UI elements]] below.

myApps will then send a [https://sdk.innovaphone.com/doc/appwebsocket/myApps.htm#SetUserActivity''SetUserActivity''] message to the PBX using the ''myApps'' protocol.

: <code>{"mt":"SetUserActivity","inactive":true}</code>

This will change the ''status'' property of the ''im:'' contact for the user's own presence and hence result in a presence update from the PBX to myApps

: <code>{"mt":"UpdateOwnPresence","presence":[{...},{"contact":"im:","activity":"","status":"closed"}]}</code>
The ''closed'' status is reflected in the grey status color when displaying a contact [[Image:myapps-inactive.png|myapps-inactive.png/|myapps-inactive.png/]].

On iOS and Android, the state is set to ''inactive'' as soon as the App is brought to background.
When myApps platform services are not available (i.e. when running the web application in a browser solely) a limited user activity monitoring is available: the state is set to active when the web page is not used for more than 5 minutes.

=== Recording ===

The new launcher offers the possibility to record the audio of incoming and outgoing calls. In order to activate that functionality the URL of the recording instance must be configured in either the PBX (PBX->myApps->Config: Recording URL) or the softphone App (Settings->Audio Recording (URL))

[[Image:PBX-Recording-Settings.png|pbx-recording-settings.png/|pbx-recording-settings.png/]] [[Image:Recording-Softphone-Settings.png|recording-softphone-settings.png/|recording-softphone-settings.png/]].

As long as that URL is configured the audio data of all calls are stored as pcap-files under that URL.
If the URL points to a CF device in the PBX, write access must be granted for that URL (PBX->Services->HTTP->Server:Public compact flash access) and if the URL points to the recording app, the files can be accessed via the recording app [[{{NAMESPACE}}:Concept_App_Service_Recordings|recording]].

Under PBX->myApps the administrator can set a certain default behaviour of the audio recording like whether or not the recording should start automatically at the beginning of the call (Recording by Default ON/OFF), only calls with external numbers should be recorded (Record external calls only) or whether or not the user should be able to start/stop the recording himself (Allow user incall recording control). Except for the last parameter these parameters can also be modified by the user in its softphone settings if the administrator doesn't set the FORCE flag.

If the user was allowed by the admin to control the recording a recording switch is active during the call when the "Media" Panel is opened. There the audio recording may be stopped and continued at will. A red recording notice is shown in the top right corner when the recording actually takes place.

[[Image:Recording-incall-switch.png|recording-incall-switch.png/|recording-incall-switch.png/]]

=== Notifications ===

The myApps platform services can use the OS specific notification mechanism (e.g. ''desktop notifications'' on Windows) to display messages (e.g. ''incoming new chat message'') to the user.

Note that the actual rendering of the notification is under control of the OS. Therefore, myApps must be allowed to show notifications and its appearance can be restricted by OS native settings.

==== Microsoft Windows Notifications ====

Microsoft Windows Server editions (2016, 2019, 2022) are just capable of showing a single ''IncomingCall'' notification at the same time (we couldn't find a workaround for this limitation). 
An ''IncomingCall'' notification is visible the whole time instead of being moved to the action center after a certain time. 
 
A notification about a missed call uses the ''IncomingCall'' type so that this notification is visible until the user returns. 
Due to the above limitation, on a new arriving call such a missed call notification is transformed to a default notification which will be moved to the action center automatically. 
 
On non server editions, you can have multiple IncomingCall notifications at the same time (so two parallel incoming calls will be indeed notified at the same time), but the missed call notification handling is the same on both platforms!

Thus there will be always just '''one''' missed call notification visible and previous missed calls can be found inside your action center!

To see myApps notifications, ensure:
* System -> Notifications
** enable notifications
** disable "Do not disturb" or allow myApps as priority application while "Do not disturb" is active
** enable notifications for myApps in the list of applications
* System -> Focus
** if a focus session is active and the "Do not disturb" is activated during a focus session, make sure that myApps is a priority application (see above)

==== macOS Notifications ====
Notifications are the same as on Windows.
The difference is, that for macOS, notifications need to be allowed in the system settings.
Go to Notifications - myApps, select Banner and enable all check marks.

=== Local phonebook access ===
'''Contact Search:''' The myApps platform services implement an ''API provider'' for the [http://sdk.innovaphone.com/web1/com.innovaphone.search/lib1_api_search.htm ''com.innovaphone.search'' API]]. They perform search capabilities on the OS' local phone books which can be used by Apps like the ''phoneapp''.

Apps would send a ''Search'' request to the API:

: <code>{"mt":"ApiRequest","consumer":"dev:SwPh_zkl_5e42e884","provider":"*","src":"4","msg":{"mt":"Search","type":"contact","search":"john doe"},"apiId":"com.innovaphone.search"}</code>
Search results are delivered as ''SearchInfo'' messages:

: <code>{"mt":"ApiResult","src":"3","provider":"@local-8125d22e37-519d-4056-bfe5-c52ef2ae8fabb0","consumer":"dev:SwPh_zkl_5e42e884","client":"@client-f62702dd86-be3f-47fc-b4bc-7a21627b75b2ea","msg":{"mt":"SearchInfo","relevance":2000,"adjust":true,"type":"contact","contact":{"givenname":"John","sn":"Doe","company":"ACME","position":"Head of everything","telephonenumber":["11111","22222"],"homephone":["+4944444","33333"],"mobile":["+49 (123) 55555"]}},"api":"com.innovaphone.search"}</code>

'''Reverse Lookup:''' The myApps platform services implement an ''API provider'' for the [http://sdk.innovaphone.com/web1/com.innovaphone.phonelookup/lib1_api_phonelookup.htm ''com.innovaphone.phonelookup'' API]. They perform search capabilities on the OS' local phone books which can be used by Apps like the ''phoneapp''.

Apps would send a ''Lookup'' request to the API:

: <code>{"mt":"ApiRequest","consumer":"dev:SwPh_zkl_5e42e884","provider":"*","src":"4","msg":{ mt: "Lookup", prefixIntl: "000", prefixNtl: "00", prefixExt:"0", area: "7031", country: "49", lookup: "0004970311234567" },"apiId":"com.innovaphone.lookup"}</code>

Search results are delivered as ''LookupInfo'' messages:

: <code>{"mt":"ApiResult","src":"3","provider":"@local-8125d22e37-519d-4056-bfe5-c52ef2ae8fabb0","consumer":"dev:SwPh_zkl_5e42e884","client":"@client-f62702dd86-be3f-47fc-b4bc-7a21627b75b2ea","msg":{mt: "LookupInfo", dn: "Jake Blues", contact: { telephonenumber: ["0004970311234567"], givenname: "Jake", sn: "Blues", company: "Blues Brothers" </code>

==== Windows ====
On Windows, the search and lookup are performed in all of the user's Outlook contact folders. As opposed to the search implemented in the ''Contacts'' and ''Users'' App, all items are returned which match any of the search words (i.e. searching for ''a b'' will return items matching either ''a'' or ''b'').

; searched properties : firstname, lastname
; returned properties : Following Outlook contact phone number properties are returned (if available):

:* OFFICE_TELEPHONE_NUMBER as ''telephonenumber''
:* OFFICE2_TELEPHONE_NUMBER as ''telephonenumber''
:* HOME_TELEPHONE_NUMBER as ''homephone''
:* HOME2_TELEPHONE_NUMBER as ''homephone''
:* MOBILE_TELEPHONE_NUMBER as ''mobile''
:* BUSINESS_FAX_NUMBER as ''facsimiletelephonenumber''
Note that contact information is cached in the search provider. Updated contacts may therefore become effective after a while only.
Outlook search will create its own trace file <code>myAppsOutlookSearch-</code>''date-time''<code>.txt</code> in the standard trace directory.

This search provider is always installed and can be disabled. There is no need (nor possibility) to enable it in the ''Apps'' tab of the PBX's user object. Also, no ''App'' object needs to be created for it.

==== Android/iOS ====
The search and lookup are performed in the contacts.

==== macOS ====
The search and lookup are performed in the contacts. If you wish to disable local contact lookup, go to system settings - Security & Privacy and disable the access to contacts for myapps.
=== Microsoft Office integration ===

The myApps platform services has a ''office presence provider'' that can provide the user's presence state to Office applications. See [[{{NAMESPACE}}:Concept_myApps_Office_Integration|myApps Office Integration]] for details.

This feature is installed by default. However, it can be disabled using the ''OFFICEPRESENCE'' MSI Parameter. Also, a check-mark is available in the setup dialog.

=== Call an external application for calls ===

Phone Apps (such as the phoneapp or softphone) can initiate the start of an external application when a new call appears (either incoming or outgoing). The actual spawning of the application is done by the myApps platform service. Also, the application properties (such as e.g. the executable's path) is configured in the myApps platform services (see [[#UI elements|Advanced settings]] in the ''UI elements'' section below).

A number of arguments can be passed to the application by substituting $-variables in the ''Parameter'' field:

; $n : phone number as dialed (called party number for outgoing calls) or received (calling party number for incoming calls)

; $N : called or calling party number in ''national'' format (e.g. 07031730090)

; $I : called or calling party number in ''international'' format (e.g. +497031730090)

: note that both $N and $I only work if $n includes both subscriber number and area code (e.g. 07031730090). Otherwise they are equal to $n

; $d : display name of peer (if known)

; $u : URI name of the peer (if available eg with a federation call)

; $c : conference id

: this is a globally unique ID for this call and may be used to relate the call to the ''guid'' found in the CallInfo structure in the [http://wiki.innovaphone.com/index.php?title=Reference10:SOAP_API#CallInfo SOAP-API] and [http://sdk.innovaphone.com/doc/appwebsocket/RCC.htm RCC-API ]. Also, corresponding [[Reference10:Call Detail Record CDR PBX|CDRs]] can be related using the ''event'' tag's ''conf'' attribute.
The start of an external application can be requested using the ''com.innovaphone.externalapps'' API.

Some setup examples are [[Howto:Integrate External Apps in innovaphone UC clients|shown here]].

=== Push ===

Mobile operating systems usually inhibit network operation of apps which run in the background or are closed by the user. This is done in order to reduce battery consumption. Unfortunately, this also stops such apps to maintain a registration by regularly sending ''keep alive'' messages to a server (in our case to the PBX). As a result, myApps will be disconnected from the PBX. When the PBX determines that there is an event for the application which needs a response, it needs to wake up the app using a dedicated channel provided by the operating system. This mechanism is know as ''push''. When running on iOS or Android, myApps supports ''push''.

For ''push'' to work, a [[{{NAMESPACE}}:PBX/Objects/Push|''push object'']] needs to be configured in the PBX . Also, it needs to be enabled on the mobile phone for the myApps app.
This mechanism is quite similar in v12 and v13, so you can refer to [[{{NAMESPACE}}:Concept_Push_Notifications_for_iOS_and_Android|the concept for push notifications for iOS and Android]] for more details.

Also, helpful hints can be found in [[Howto:Troubleshoot v13 Push with myApps for Android and iOS]].

=== App Proxy ===

myApps runs further ''Apps'' (such as e.g. the ''phoneapp'') as a web page in an IFRAME of the browser myApps is running in. The App's page code is loaded either from the PBX or from an ''application platform'' (AP). This however would mean that the App's IFRAME would remain empty (a dead white screen) when the PBX or AP is not available. To make sure the App can start-up anyway, the myApps platform services feature the so-called ''App Proxy''. This is a caching proxy that caches all the App code so it is available even in case of network failure. When myApps runs in the context of the platform services, Apps are therefore not loaded from the App source directly, but from the local App proxy.

The cached files are stored in the PCs local file system in the <code>%LOCALAPPDATA%\innovaphone\myApps\appproxy</path></code>. There is no configuration required. However, if myApps seems to run with outdated or corrupt cached copies of the App, you can safely delete the entire directory.

=== Auto update ===

On Windows and on macOS, the myApps platform services can auto-update themselves to a common version. This is controlled by the [[{{NAMESPACE}}:PBX/Config/myApps#Launcher_Software_Update | ''Launcher Software Update'']] settings under ''PBX/Config/myApps'' in the PBX.

When myApps is started or the user logs in or myApps needs to re-connect to the PBX, the platform services will use the [http://sdk.innovaphone.com/web1/com.innovaphone.client/lib1_api_client.htm com.innovaphone.client API] to learn the desired version (''launcherUpdateBuild'', which is part of the API's ''model''). If this differs from the current version, the platform services will try to download the respective new version.

{
"mt": "ApiUpdate",
"apis": {
"com.innovaphone.client": {
"@client": {
"title": "innovaphone myApps",
"model": {
"launcher": true,
"launcherUpdateBuild": "134906",
"appStoreUrl": "http://store.innovaphone.com/release/download/"
}
}
}
}
}

The installation of the downloaded version is done by the ''innovaphonemyAppsUpdateService''. This service is installed and enabled during the initial installation of the myApps platform services. To disable auto-update, either leave the ''Launcher Software Update'' settings empty or set the service's start mode to ''disabled'' in the Windows ''services control panel''.

Note that on Windows the update service does not work on terminal servers. Administrators must do myApps base services updates using standard windows mechanisms.

Note that on macOS if myApps has been installed from the Apple Store it is assumed that auto update from the PBX is not desired and disabled therefore. If you need to activate the auto update later, you will need to reinstall myApps using the .pkg file.
On Android/iOS/macOS updates can be downloaded from the respective app store.

The ''Devices'' app can not update software installed on Windows PCs directly. However, when the PBX is updated using an ''update job'' in the ''Devices'' App, the ''Launcher Software Update'' settings will be updated accordingly and hence the myApps base services will ultimately also be updated to the same version.

==== Auto update flow on Windows ====

* On start of myApps, myApps checks if an update is available and ready for installation
** if yes, the update is installed directly, without user interaction (a popup is shown during the installation)
** if not, myApps starts
* if an update is available while myApps is already running, an update notification will be shown which let's the user choose to install the update now or later (the notification will then popup again after one hour)

==UI elements ==
There are a few user interfaces provided by the platform services:
===tray-icon (Windows only) ===
::[[Image:myapps-tray.png|myapps-tray.png/|myapps-tray.png/]]
:Allows to
:* terminate myApps
:* toggle the ''autostart'' state
:* toggle the ''show in task bar'' state
:* open the trace folder
:
=== PBX connect form===
:: [[Image:myapps-connect.png|myapps-connect.png/|myapps-connect.png/]]
: Allows the user to specify the connect data for the PBX (i.e. IP address or DNS name)
:
=== Advanced settings===
[[Image:myapps-settings0.png| More button to access advanced settings]]
<gallery mode="packed" heights="420" style="float:left">
Image:MyApps-settingsNew.png|Advanced generic configuration
Image:MyApps-settingsNew2.png|Hotkeys configuration
Image:MyApps-settingsNew3.png|External launcher configuration
Image:MyApps-settingsNew4.png|Trace configuration
</gallery>
<div style="clear:both;"></div>

: Allows modification of various platform dependent settings (such as the hotkey selection on Windows, external application actions, etc).

== Interfaces ==
=== Provided APIs ===

; [http://sdk.innovaphone.com/web1/com.innovaphone.search/lib1_api_search.htm com.innovaphone.search] : access to local phone book entries by the [[#Local phonebook access|Local phonebook access]] component.
; [http://sdk.innovaphone.com/web1/com.innovaphone.launcher/com.innovaphone.launcher.htm com.innovaphone.launcher] : display of OS specific user notifications and receipt of related user actions
; com.innovaphone.notificationhandler : reports back click on a notification.
; com.innovaphone.externalapps : to start external applications, see [[#Call an external application for calls|Call an external application for calls]] above

=== Used APIs ===

; [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm com.innovaphone.phone] : used to initiate new or manipulate existing calls by the [[#Hot keys|Hot keys]] and [[#URL handler|URL handler]] components.

; [http://sdk.innovaphone.com/web1/com.innovaphone.chat/com.innovaphone.chat.htm com.innovaphone.chat] : used to start a new chat by the [[#URL handler|URL handler]] component.

; [http://sdk.innovaphone.com/web1/com.innovaphone.client/lib1_api_client.htm com.innovaphone.client] : the model is used to learn the update settings, see [[#Auto update|Auto update]] above

=== Protocols ===

; [https://sdk.innovaphone.com/doc/launcher/Media.htm Media Protocol] : used by apps to allocate RTP channels, see [[#RTP service for audio.2C video and data|RTP service for audio, video and data]] above

== Related App Services ==

none

== Known limitations ==
; Incoming call as banner on myApps for iOS : Since iOS 14 the iOS CallKit presents incoming calls as a banner leaving the original green answer button of myApps visible. Use only the blue button of the banner to accept the call or change iPhone Settings, App "Phone", "Incoming Calls" to "Full Screen" to hide the myApps user interface again during call answering.

; Call answer in speakerphone mode even with active Bluetooth headset on myApps for iOS : This causes unwanted speakerphone operation if the smartphone is used with a Bluetooth car audio system. The behaviour can be changed by selecting ''Bluetooth Headset'' in this setting:
:''iOS Settings->Accessibility->Touch->Call Audio Routing: Automatic / Bluetooth Headset / Speaker''
:''iOS Einstellungen->Bedienungshilfen->Tippen->Anrufaudioausgabe: Automatisch / Bluetooth-Headset / Lautsprecher''

; Windows Server 2016 (Windows 10 Build 1607) : windows just shows the first notification. Further notifications aren't displayed until the previous ones are removed from the notification center. Current windows builds do not show this behaviour anymore.

; Problems on Mac computers with Yealink USB headsets
: we have received reports that myApps quits unexpectedly on some Mac computers when a Yealink headset is plugged in. Unfortunately, we could not find out the cause yet. If you use Yealink USB headsets and have a similar issue, please open a support ticket and send myApps traces.

; Poly / Plantronics headset buttons only functional if myApps is started with Rosetta
: myApps macOS supports Apple M1/M2 hardware natively. However, the Poly / Plantronics headset SDK is only available for Intel platform and thus myApps needs to be started via Apple's Intel emulator Rosetta if a Poly / Plantronics headset is used. This is done with right-click on the myApps executable, ''Information'', ''Open with Rosetta''.

; Windows surface devices may not work correctly
: Chromium does not get touch keyboard events. USB Keyboards may not be recognized either.

= Installation =

== Windows ==

myApps platform services are installed on Windows using the .msi file found in the ''myApps Windows'' package from [https://store.innovaphone.com/release/download.htm store.innovaphone.com].

myApps can update itself automatically, see [[#Auto update|Auto update]] above.

=== MSI Parameters and install options ===

The MSI installer of myApps for Windows supports the following parameters and can be edited with [https://docs.microsoft.com/en-us/windows/win32/msi/orca-exe Microsoft Orca]. You can add your parameters in the table ''property''.

; SERVER (REG_SZ): the PBX's server address (without protocol like https://)
; OFFICEPRESENCE (REG_DWORD): '''false''' to disable presence integration in Microsoft Office
: this is also available as a check-mark when running the install manually

; DISABLEHEADSETS (REG_DWORD): '''true''' to disable headsets support, see [[#Device handling|Device handling]] above

; EXTERNALAPPS (REG_SZ): pre-define external applications, see [[#Call an external application for calls|Call an external application for calls]] above
: e.g. <code>"{""externalApps"":[{""id"":0,""name"":""Wireshark"",""path"":""C:\\Program Files\\Wireshark\\Wireshark.exe"",""param"":""test $I""}]}"</code>

; FORCERESTART (REG_DWORD): '''true''' (or any string ...) kills myApps during the installation and restarts it for the currently logged in user, if it was running

; DISABLELOCALHOST (REG_DWORD): '''true''' to disable use of '''localhost''' string to access the local webserver. Use '''127.0.0.1''' instead

; EXCLUDEINTERFACES (REG_SZ): some VPN interfaces are not detected by Windows as IF_TYPE_PPP or IF_TYPE_TUNNEL and therefore the '''media outside VPN''' setting is not taking effect. With this option interfaces can be pre-defined that will not be used for media. Interfaces must be comma separated
: e.g. <code>EXCLUDEINTERFACES="172,192.168,10.10"</code>

; FASTERDOWNLOADS (REG_DWORD): '''true''' to have faster downloads without artificially slowing down the download of an update (which is done to avoid audio lags if clients have slow networks).

Current settings are stored in the registry at <code>Computer\HKEY_CURRENT_USER\Software\innovaphone\myApps</code> or at <code>Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\innovaphone\myApps</code>

Boolean values like OfficePresence are stored in registry entries with type REG_DWORD and values 1 or 0. 0 disables the setting and 1 enables it.

== iOS ==

myApps platform services are installed on iOS by loading ''innovaphone myApps'' from the ''App Store''.

=== Configuration via MDM ===

the PBX's server URL can be pre-configured by specifying this dictionary in the MDM
<plist>
<dict>
<key>server</key>
<string>pbx.example.com</string>
</dict>
</plist>

== macOS ==

myApps platform services might be installed directly from the Apple store. An installer package <code>myapps.pkg</code> and a disk image <code>myapps.dmg</code> is also available from the innovaphone app store. Install <code>myapps.pkg</code> by double-click on the file and follow the instructions of the installer. myApps becomes available in the Applications folder and can be opened by double-click. Or download and open <code>myapps.dmg</code> and double klick myApps. If desired integrate it into the app dock by right click, ''Options, Keep in the dock''.

If installed from the innovaphone app store, myApps can update itself automatically, see [[#Auto update|Auto update]] above.

If installed from the Apple store, macOS notifies about updates on the Apple store. myApps [[#Auto update|Auto update]] is disabled then.

If a clean-install of the client is necessary, the folder "/Users/username/Library/Containers/myapps" needs to be deleted. To be on the safe side also delete it from the trash bin.

=== Configuration via MDM ===

the PBX's server URL can be pre-configured by specifying this dictionary in the MDM
<plist>
<dict>
<key>server</key>
<string>pbx.example.com</string>
</dict>
</plist>

=== Preferences ===

macOS supports preference settings that can be set via a shell command or via Mac remote management

defaults write com.innovaphone.client-ios-14r1 server "PBX-server-URL"

The following parameters and can be set through this method:

; server: the PBX's server URL

=== Setting myApps as Default App for SIP-URLs ===

{| class="wikitable"
|defaults write com.apple.LaunchServices/com.apple.launchservices.secure LSHandlers -array-add '{
LSHandlerURLScheme = sip;
LSHandlerRoleAll = "<CFBundleIdentifier>";
}'
|}

To find the “CFBundleIdentifier”, proceed as follows:
* In the Finder under “Applications”, search for the desired myApps client that you want to set as the default app.
* Right-click on “Show package contents” -> you will find the “CFBundleIdentifier” in the Info.plist file.

A restart of the MAC is required.

=== Using Sennheiser headsets ===
If you use Sennheiser headsets, you should also install the then-current <code>DSEA_SDK_v</code>''version''<code>.pkg</code> package, after you installed the myApps client. Without that, audio will still work, but not the controls on the headset. You will need to keep that up-to-date yourself, as it is not updated by myApps's auto-update function.

== Android ==

myApps platform services are installed on Android by loading ''innovaphone myApps'' from the ''Play Store''.

=== Configuration via MDM ===

the PBX's server URL can be pre-configured by specifying a property "server" with string value "pbx.example.com" in the MDM.

== IP270 ==
For configuration instructions, refer to the [[Reference16r1:Concept IP270|IP270 concept article]].

= Configuration =

== Server configuration ==
When opening myApps for the first time, the user is prompted for the Server. Usually only the hostname (DNS host name or IP address) needs to be configured.

But there are more options for special PBX configurations.

; Non-standard HTTPS port
: If the PBX uses a non-standard HTTPS port, it must be appended to the host name separated by a colon (<code>:</code>).
: Example: <code>pbx.example.com:4444</code> (expands to <code>https://pbx.example.com:4444/PBX0/APPCLIENT/appclient.htm</code>)
; DynPBX module name
: If the PBX is a DynPBX, the module id must be appended to PBX0 separated - (<code>/</code>).
: Example: <code>pbx.example.com/PBX0-1</code> (expands to <code>https://pbx.example.com/PBX0-1/APPCLIENT/appclient.htm</code>)
; Softphone physical location
: If user defined physical location shall be used for softphone, you can append it using a parameter <code>#phys=</code>.
: Example: <code>pbx.example.com#phys=slave</code> (expands to <code>https://pbx.example.com/PBX0/APPCLIENT/appclient.htm#phys=slave</code>)

Example 1: PBX pbx.example.com with standard configuration
pbx.example.com

Example 2: PBX slave.example with DynPBX module ID 1, HTTPS port 4444 and physical location master
slave.example.com:4444/PBX0-1#phys=master

=== HTTP proxy support ===

myApps platform services do support operation via HTTP proxy now. If one or more proxies have been configured in the network settings of the operating system for the active network connection, HTTP CONNECT tunnels are established.

On Windows user name and password can be specified for the tunnel servers as generic credentials in the credentials manager (Anmeldeinformationsverwaltung). The name of the credentials must be the tunnel server hostname.

On Android user name and password can be specified through Android ''Settings, Accounts'' by adding a myApps ''HTTP Proxy Credentials'' account. The name of the account must be the tunnel server hostname.

== Platform specific settings ==
When myApps runs under the myApps platform services, it will show various platform specific settings as part of its ''burger menu'', so the user can set them. See ''Advanced settings'' in [[#UI elements|UI elements]] above.

Some options can also be set globally for all myApps clients in the PBX's [[{{NAMESPACE}}:PBX/Config/myApps#Client_Settings|PBX/Config/myApps ''Client Settings'']]
{|
! style="text-align: left; font-weight: bold" | Option

! style="text-align: left; font-weight: bold" | Description

! style="text-align: left; font-weight: bold" | Where to set

!
! style="text-align: left; font-weight: bold"| Availability
|-

| || || User menu || PBX ''Client Settings'' || Windows || iOS || Android || macOS
|IP270<ref>myApps-IP270 offers device specific settings explained in [[Reference16r1:Concept IP270|IP270 concept article]]</ref>
|-
| Autostart || Launch myApps on login || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Appear offline after || controls after which idle time a user is considered ''inactive''. See [[#User activity|User activity]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Hotkeys || Hotkeys for call dial, accept, reject. See [[#Hot keys|Hot keys]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Docking || Docking mode (left, right, none). See [[#???|??]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✗
|✗
|-

| Desktop notifications|| Turn on/off platform notifications. See [[#Notifications| Notifications]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| VPN || Disable VPN address for ICE candidate selection. See [[#RTP ports| RTP ports]] above || ✔ ||✔ ||✔ || ✗ || ✔ || ✔
|✗
|-

| Show in taskbar|| Show myApps in the taskbar in addition to it's tray icon. || ✔ ||✗ ||✔ || ✗ || ✗ || ✗
|✗
|-

| Log flags || turn on/off certain trace levels. See [[#Troubleshooting|Troubleshooting]] below. || ✔ ||✔ ||✔ || ✔ || ✔ || ✔
|✔

|-

| External applications || define the applications available for Apps to be started. See [[#Call an external application for calls|Call an external application for calls]] above. || ✔ ||✗ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Ring in headset || send ring tone for incoming to headset instead of loudspeaker. || ✔ ||✗ ||✔ || ✗ || ✗ || ✗
|✗
|}
<references/>

== Start parameters for Windows ==

On Windows, it is not possible to pass start parameters from the [https://www.chromium.org/developers Chromium documentation] to the myApps process.

== OS Settings for Windows ==
Windows settings can influence the display of ''Desktop notifications''. See [https://support.microsoft.com/en-us/help/4028678/windows-10-change-notification-settings Change notification settings in Windows 10/11] for details.

=== Windows 11 ===

* Windows 11 has a feature "do not disturb". This hides notifications if enabled.
* Windows 11 has a feature "focus". This enables "do not disturb" and thus hides notifications too.
* Windows 11 has priority settings for notifications. Ensure that VoIP notifications for calls are allowed any maybe also include myApps as an App which is allowed to show notifications.

== OS settings for Android ==
; Events : The appearance of notifications can be controlled here.

; Call accounts : For proper incoming call signaling, the call account ''myApps'' needs to be enabled. Note that on Samsung smartphones the call account switch likely toggles back and a few tries may need to be done until it persists. Please double-check the state.

; Preferred Calling Account : Choose which calling account (myApps/SIM/..) should be used for outgoing calls initiated from within the native phone app / phone book.

; Background data, unlimited data usage : Grant background data use to enable ''myApps'' to connect to the PBX immediately on an incoming call.

; Overlaying : This setting is not needed if call account ''myApps'' has been enabled. Should there be a reason for not enabling call account ''myApps'', the permission for overlaying needs to be granted on Android 10 or higher for proper call signaling. On Android 17 overlaying (navigate to ''Settings'', select ''Apps'', tap ''Special app access'' (or the menu icon), choose ''Display over other apps'') might show ''deactivated''. Navigate and click ''Android Settings -> Apps -> myApps -> 3 dots menu -> Enable restricted settings'' to release this deactivation and then grant the permission.

Note: If no SIM card is installed some Android smartphones exhibit a problem dialing from the smartphone contacts. The contacts app shows a choice ''Select SIM card for this call'' but all possible dialers are greyed out. In this case make myApps the default phone app in Android settings ''Apps, Default apps, Telephony''.

== OS settings for iOS ==
; Notifications : The appearance of notifications can be controlled in iOS ''Settings, myApps''.

== OS settings for macOS ==

; Notifications : The appearance of notifications can be controlled in macOS ''Preferences, Notifications, myApps''.

=Troubleshooting=

myApps platform services can write various traces for debugging. Trace can be turned on and off selectively in the [[#Advanced settings|Advanced settings]].

The following trace flags can be set:

(''Recommended trace options are: '''App, Browser, ICE, TURN, Signaling and Audio'''. Please do not activate other flags unless innovaphone support says otherwise'')

{|
!style="text-align: left; font-weight: bold" | Abbreviation

!style="text-align: left; font-weight: bold" |code

!style="text-align: left; font-weight: bold" | description

|-
| App||0x000000001|| logs from the App Service itself
|-
| DNS||0x000000008|| logs DNS requests and results
|-
| HTTP client||0x000000080|| http client logs
|-
| TLS||0x000000400|| TLS logs
|-
| TCP||0x000000800|| TCP logs
|-
| LDS||0x000001000|| local domain sockets
|-
| WebSocket client||0x000004000|| logs outgoing websocket connections
|-
| App WebSocket||0x000008000|| logs app websocket connections (e.g. from PBX objects to an App Service or from the UI to the App Service)
|-
| UDP||0x000200000|| UDP logs
|-
| DTLS||0x000400000|| logs DTLS handshake and messages
|-
| Media||0x000800000|| logs media events
|-
| Media channel||0x001000000|| logs RTP/SCTP media connections
|-
| ICE||0x002000000|| logs ICE messages between peers
|-
| TURN||0x004000000|| logs TURN messages between peers
|-
| AppSharing||0x008000000|| logs AppSharing connection
|-
| Audio||0x010000000|| logs Audio connection and headset events
|-
| Video||0x020000000|| logs video connection and webcam events
|-
| Browser||0x040000000|| logs Chromium events
|-
| AppProxy||0x080000000|| logs requests which are proxied between the local webserver and the remote server
|-
| Webserver ||0x200000000|| enables webserver specific logs
|-
| Browser Console ||0x400000000|| logs browser console events
|-
| Signaling||0x800000000|| enables logs in the signaling module for debugging calls
|}
''code'' can be or'ed and used as value for the ''Log flags'' field in [[{{NAMESPACE}}:PBX/Config/myApps#Client_Settings|PBX/Config/myApps/Client Settings]].

== Windows ==
On Windows, traces are written to the <code>%LOCALAPPDATA%\innovaphone\myApps</code> directory. If you start myApps with --log-size as parameter, you can define the maximum size of a log file (e.g. --log-size=100000000 would be 100MB for each file)

:* myApps-''date-time''.txt : main log file for the platform services

:* myAppsOutlookSearch-''date-time''.txt : log file for the Outlook phone book access

:* myAppsHookController-''date-time''.txt : log file for the hot-key interceptor (see [[#Hot keys|Hot keys]])

; :myApps update installation traces are written to the <code>%windir%\temp\</code> directory.
:* myAppsInstall.txt: MSI installation file

; :myApps update service traces are written to the <code>%ProgramData%\innovaphone\myAppsUpdateService</code> directory.
:* myAppsUpdateService-''date-time''.txt: myApps update service traces

==Android==
traces can be sent by e-mail.

Also, an Android device might also be connected to a PC via an USB cable to get the traces. The files can be found in <code>Android/data/com.innovaphone.clientandroid/files</code>

== iOS ==
traces can be sent by e-mail.

== macOS ==
traces can be sent by e-mail.

Also, files can be found in <code>~/Library/Containers/com.innovaphone.client-ios/Data/Documents/</code>. Press ''Alt+N'' followed by space to get tilde ''~''.

== IP270 ==
Refer to the [[Reference16r1:Concept IP270#Troubleshooting|IP270 concept article section troubleshooting]].

= Known Problems =
[[:Category:Problem myApps platform services|Known Problems]]

= Related Articles =
* [[{{NAMESPACE}}:Concept_myApps]]
* [[{{NAMESPACE}}:Concept_myApps_Redundancy|Concept myApps Redundancy]]
* [[{{NAMESPACE}}:Concept_myApps_Office_Integration|Concept myApps Office Integration]]
* [[{{NAMESPACE}}:Concept_myAPPs_Search_in_local-Outlook_Contacts|Concept myAPPs Search in local Outlook Contacts]]
* [[{{NAMESPACE}}:Call_Detail_Record_CDR_PBX|Call Detail Records]]
* [[{{NAMESPACE}}:Concept Push Notifications for myPBX iOS and Android|Concept Push Notifications for myPBX iOS and Android]]
* [[Howto:Troubleshoot v13 Push with myApps for Android and iOS]]
* [[{{NAMESPACE}}:PBX/Config/myApps|Reference16r1:PBX/Config/myApps]]
* [[{{NAMESPACE}}:Concept_IP270|IP270 concept article]]
[[Category:Concept myApps platform services]]

Reference16r1:Concept myApps platform services

2026-08-23T10:23:23Z

Tmo: /* OS settings for Android */

[[Category:Concept|myApps]]

myApps platform services provide various operating system specific services which can be used by other ''Apps'' running in the [[{{NAMESPACE}}:Concept myApps|myApps client]]. Those services typically are not available in the browser's JavaScript environment and hence must be implemented in native platform code. Therefore, the platform services are installed as native executable on the respective platform.

When myApps is started in a web browser (and hence has no access to the platform services), some Apps will use [https://en.wikipedia.org/wiki/WebRTC WebRTC] services implemented by the browser instead. For ease of reference, features available in this scenario are also described here.

On windows, the platform services also come with their own web browser in which the myApps web App will be started then. This browser is based on google's [https://en.wikipedia.org/wiki/Chromium_(web_browser) Chromium] open source software.
= Applies To =

* [[{{NAMESPACE}}:Concept myApps|myApps]]
* myApps for Windows
* myApps for macOS
* myApps for iOS
* myApps for Android
* myApps Web App (WebRTC)
* myApps for IP270
version 16r1

=Features=
Not all features are available or required on all platforms.
{|
! style="text-align: left; font-weight: bold" | Feature
! style="text-align: left; font-weight: bold" | Description
! style="text-align: left; font-weight: bold"| Availability
|-
| || || Windows || iOS || Android || macOS || Browser<ref>This refers to the myApps web application running in a browser with no platform services available</ref>
|IP270
|-
| [[#Device handling|Audio Devices]]|| manage local audio devices to record and playback audio conversations || ✔ || ✔ || ✔ || ✔ || ✔<ref>audio available but devices managed by web browser</ref>|| ✔
|-
| Video || manage local displays and cameras to capture and render video live stream || ✔ || ✔ || ✔ || ✔ || ✔<ref>video available but devices managed by web browser</ref>|| ✔
|-
| Ringer || manage local ringing device || ✔ || ✔ || ✔ || ✔ || ✔ || ✔
|-
| [[#Application sharing|Application sharing]]
|-
|   presenter || share an application || ✔ || ✗ || ✔ || ✔ || ✔ || ✔
|-
|   consumer || view an application shared by the peer || ✔ || ✔ || ✔ || ✔ || ✔ || ✔
|-
| [[#Hot keys|Hot keys]]|| capture key presses for quick invocation of phone apps (e.g. dial selected number) || ✔ || ✗ || ✗ || ✔ || ✗ || ✗
|-
| [[#URL Handler|tel: and sip: URI handler]]|| intercept clicks on tel: and sip: links in web sites to invoke phone apps || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| [[#User activity|User activity]]|| set presence state according to user activity || ✔ || ✗ || ✗ || ✔ || ✔<ref>limited, see [[#User activity|User activity]] below</ref> || ✔
|-
| Docking || myApps can be docked persistently to the right or left edge of your screens || ✔ || ✗ || ✗ || ✗ || ✗ || ✗
|-
| Multi-windowing || Apps can be launched in separate windows|| ✔ || ✗ || ✗ || ✔ || ✗ || ✗
|-
| [[#Recording|Recording]]|| Calls can be recorded to recording app|| ✔ || ✔ || ✔ || ✔ || ✗ || ✔
|-
| [[#Notifications|Notifications]]|| ||
|-
|   display notifications || display notifications with OS standard mechanism || ✔ || ✔ || ✔ || ✔ || ✔ || ✗
|-
|   push notifications || receive push notifications while myApps is not running || ✗ || ✔ || ✔ || ✔ || ✔<ref>The browser needs to be running in order to receive push notifications.</ref> || ✗
|-
|   chat and apps || display notifications for chat and other apps || ✔ || ✔ || ✔ || ✔ || ✔ || ✗
|-
|   calls || display notifications for incoming calls || ✔ || ✔ || ✔ || ✔ || ✗<ref>Call notifications are only displayed locally while the phone or softphone app is started.</ref> || ✗
|-
| [[#Local phonebook access|Local phonebook]]|| access local phone book || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| [[#Microsoft Office Integration|Office presence provider]]|| maps PBX presence state to Microsoft office presence state || ✔ || ✗ || ✗ || ✗ || ✗ || ✗
|-
| [[#Call an external application for calls|External application start]]|| start arbitrary external applications for calls || ✔ || ✗ || ✗ || ✔ || ✗ || ✗
|-
| [[#App Proxy|App Proxy]]|| a caching proxy that provides app persistence || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| [[#Auto update|Auto update]]|| automatically updates myApps platform services to the same version the PBX has || ✔ || ✔ || ✗ || ✔ || ✔<ref>The then-current web app is always loaded from the PBX upon startup and hence up-to-date by definition</ref> || ✔
|-
| Three party conference || initiate 3-pty-conference using Softphone-App || ✔ || ✔ || ✔ || ✔ || ✗ || ✔
|-
| Exclude VPN || disable use of VPN connections for audio and appsharing || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| Screen lock || myApps screen lock against unauthorised use || ✗ || ✗ || ✗ || ✗ || ✗ || ✔
|}

<references/>

=Requirements=
* innovaphone PBX 16r1 and up

== Hardware ==
Recommended hardware requirements
* Processor: Dual-core 2Ghz or higher
* RAM: 4 Gb

== myApps for Windows ==
* Windows 11 and up
* Windows Server 2016 and later versions

=== 32 & 64 bit Windows ===
* 32 bit Windows: install the myAppsSetup32.msi from the App Store
* 64 bit Windows: install the myAppsSetup.msi from the App Store
** the 64 bit variant still installs into Program Files (x86), as the main myApps.exe is still a 32bit application
** the 64 bit variant just contains an additional 64 bit binary for the outlook search

=== Windows N editions ===

Windows N editions are missing the ''Media Feature Pack'' which is pre installed on other Windows versions.

Please install the pack from [https://www.microsoft.com/en-us/software-download/mediafeaturepack Microsoft (Windows 10 pack)] before you install myApps. The installer will check if the file <code>C:\Windows\SysWOW64\mfplat.dll</code> exist on your system.

Make sure to install the correct pack depending on your Windows version! There are different packs for Windows 10 1703, 1803, 1809 and 32bit or 64bit etc.

NB: Sometimes the myApps installation will not work even though the media pack is already installed. This is because the installer has no read access to check if the package is already installed. If the above-mentioned file exists and the installer asks to install the Windows Media Feature Pack nevertheless, you have to start the myApps install with administrative rights.

=== Terminal Server environments ===

Audio driver was removed if myApps discovers that it is running in a terminal server environment like Citrix.

The audio driver is needed for the Softphone App but the Softphone App should not use an audio driver at the server side because the audio devices are plugged locally and there would be a delay sending and receiving audio data with the server.

If a customer wants to use the Softphone App at the server side he needs to make use of the myApps Plugin for virtual desktops solution:

[[{{NAMESPACE}}:MyApps_Plugin_for_Virtual_Desktops|Reference15r1:MyApps_Plugin_for_Virtual_Desktops]]

== myApps for macOS ==
* macOS 13 or higher

== myApps for iOS ==
* iOS 16 or higher

== myApps for Android ==
* Android 13 or higher.

== myApps for IP270 ==
Exclusively used in IP270.

= Licenses =
* No license needed for myApps platform services

= Overview =
myApps platform services is a native executable that is installed using the standard mechanisms on the respective operating system. It provides various advanced services which can be used by the myApps web client code as well as the Apps running in the myApps context.

Also, on Windows, the platform services come with their own, dedicated browser to run myApps in. This browser is based on [https://en.wikipedia.org/wiki/Chromium_(web_browser) Chromium]. On iOS, macOS and Android, it is based upon native embedded web view facilities (such as WKWebView) instead.
== Components ==

=== RTP service for audio and appsharing ===
The RTP service provides audio and appsharing as a video stream. VoIP RTP endpoints (e.g. for softphones). It supports STUN, TURN, ICE, SRTP, DTLS. Note however that unlike WebRTC, these endpoints do not ''require'' ICE and DTLS. In other words, they can communicate also with non-compliant (i.e. older) VoIP devices.

Note that the available capabilities when not running the myApps platform services depend on the used browser's WebRTC implementation. See your browser documentation for details.

Apps can request RTP channels using the [https://sdk.innovaphone.com/doc/launcher/Media.htm Media Protocol]'s ''AllocChannel'' message.

==== RTP ports ====
{|
| audio || 50000 -> 50099
|-
| video (app sharing) || 50100 -> 50199
|}

The RTP service will enumerate all local interfaces and create local HOST candidates for ICE. There is an option however to disregard VPN interfaces (more precisely such interfaces with type of ''IF_TYPE_PPP'' or ''IF_TYPE_TUNNEL''). This can eliminate quality issues when RTP data is transmitted through TCP based VPN tunnels.

SRFLX and RELAY candidates are obtained using the STUN and TURN server configuration passed by the App (e.g the ''softphone'' App) as part of the ''AllocChannel'' request.
<code>{"mt":"AllocChannel","channel":"81429cba-396d-43de-8a76-ec020ba8796e","iceServers":[{"urls":"turn:myturn.domaincom:4077?transport=udp","username":"turnuser","credential":"pwd","credentialType":"password"},{"urls":"stun:mystun.domain.com:4077"}],"dn":"Foo Bar","type":"RemoteRtp","kind":"video"}</code>

==== Codecs ====
The installed myApps launchers provide codecs that can be used by softphone apps for media streams. When running in a web browser the codecs depend on the browser version and operating system. See the documentation of your browser for details.

The following codecs are supported:
{|
!style="text-align:left;width:200px;"|Codec
!style="width:100px"|Windows-Launcher
!style="width:100px"|Android
!style="width:100px"|iOS
!style="width:100px"|macOS
!style="width:100px"|Firefox (Browser)
!style="width:100px"|Chrome (Browser)
!style="width:100px"|Edge (Browser)
!style="width:100px"|Safari (Browser)
!style="width:100px"|Opera (Browser)
!style="width:100px"|IP270
|-
|style="text-align:left; background-color:lightgray" colspan="11"|Audio
|
|-
|G711A
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|G711u
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|G722
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|G729 (since 15r1sr16/16r1sr4)
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|[https://caniuse.com/#search=Opus OPUS-NB]
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|[https://caniuse.com/#search=Opus OPUS-WB]
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
| colspan="11" style="text-align:left; background-color:lightgray" |Video
|
|-
|[https://caniuse.com/#search=VP8 VP8]
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|-
|[https://caniuse.com/#search=VP9 VP9]
|style="color:green;text-align:center"|✔**
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|-
|[https://caniuse.com/#search=H264 H264]
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|style="text-align:left; background-color:lightgray" colspan="11"|Application Sharing
|
|-
|Share
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|Watch
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔*
|style="color:green;text-align:center"|✔*
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔*
|}

''* small presentation only'' 
''** only for 1:1 calls, not for conferences

==== Video capture ====
The default resolution for video capture is 1920x1080 if available. Otherwise, 1280x720, 640x480, 352x288 or 320x240 will be used. The frame rate is 30 fps if available, otherwise 15 fps. The resulting average bandwidth could reach 1 Mbps.

==== Application sharing ====
Screen content will be transmitted as video stream by the presenter

==== Device handling ====
The RTP service enumerates microphones, loudspeaker, cameras and ringing devices and notifies apps when devices come and go. It is up to the apps using the devices to store preferences.

The RTP service also enables some extended features (such as hook switch or volume control) for supported USB headsets or Bluetooth headsets connected to myApps.
The supported headset-SDKs determine which headset vendors are recommended to be used with the myApps softphone app. 

For this to work, the following vendor specific development kits are integrated in our myApps client. Be aware that the SDK are updated within our Service release :

{| class="wikitable"
|-
! SDK Vendor !! Supported OS !! SDK Version !! innovaphone Service Release
|-
| Jabra|| MacOS || 1.16.4.0 || 14r2sr11
|-
||| Windows || 1.16.4.0 || 15r1sr3
|-
| Epos ''(formerly Sennheiser)'' || MacOS || 12.4.0.5478 || 14r1sr3
|-
||| Windows || n.a. - [[Support:13r3 sr10 MyApps Windows Client - Epos/Sennheiser-Headsets require installed Epos-Connect Software|to be installed separately]]|| 13r3sr10
|-
| Poly ''(formerly Plantronics)'' || MacOS || 3.25.53799.37131 || 13r3sr9
|-
||| Windows || 3.25.53800.37131 || 13r3sr10
|-
| Yealink || MacOS || 3.1.1.23 || 14r2sr1
|-
||| Windows || 3.1.1.23 || 14r2sr2
|}

Notes:
* It is possible to inhibit the start of the Sennheiser SDK (SenncomSDK.exe) using the <code>DISABLEHEADSETS</code> directive of the installer (see [[#MSI Parameters and install options| MSI parameters]] below).

* Starting with V13r3sr10, the Epos-SDK needs to be installed separately using the Epos Connect software to ensure full compatibility between current Epos headset models and native myApps-Windows client. For details [[Support:13r3 sr10 MyApps Windows Client - Epos/Sennheiser-Headsets require installed Epos-Connect Software|refer to this article]].


myApps-IP270 supports use of [[Reference9:Concept USB Headset|USB devices known for innovpahone desk phones]].

==== Ring tones ====
Ring tones can be played. Apps can choose the tone from a pre-defined list of ring tones.

On Windows, custom ring tones can be uploaded as .mp3 files to the <code>ringtones</code> sub-directory of myApps' roaming directory (which usually is in <code>%appdata%\innovaphone\myApps\ringtones</code>).

On Android, custom ring tones can be added to the system via Android settings.

On iOS, custom ring tones can be uploaded as .mp3 files to the <code>Ringtones</code> subdirectory of the myApps file share that is available in iTunes if the iPhone has been connected via USB.

On macOS, custom ring tones can be uploaded as .mp3 files to <code>~/Library/Containers/com.innovaphone.client-macos/Data/Documents/Ringtones</code>.

==== Debugging ====
For extended debugging, turn on the ''Audio'', ''Media'' and ''AppSharing'' traces in myApps.
=== Hot keys ===
On Windows and macOS systems, myApps platform services can listen for hot keys and invoke certain functions. Invocation is done by sending API messages to myApps which passes it to an appropriate API provider (in the cases described here, this will be a ''phone'' or ''softphone'' or ''rcc'' App typically. See [[{{NAMESPACE}}:Concept_myApps#Client_APIs_and_default_apps | Client APIs and default apps]] for more details about this mechanism.

The hot keys can be specified using the ''advanced settings'' user interface (see [[#UI elements| UI elements]] below. Any of the function keys F1 to F11 (optionally combined with up to two modifier keys ''alt'', ''ctrl'', ''shift'' or ''win'') can be chosen for each function. If you do not want to start the call with "Hotkey+Enter" because you would have to wait for the focus, the hotkey can also be pressed twice and the number is dialled directly.

; dial selected number : Initiates a call using the currently selected text as target.

: A ''PrepareCall'' message with the ''text'' argument set to the selected text and the ''adjust'' argument set to <code>true</code> will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].

:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":"mt":"PrepareCall","text":"13","adjust":true}}</code>

; accept call : Accepts a currently alerting call.

: A ''ConnectCall'' message will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].

:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"ConnectCall"}}</code>

; reject/disconnect call : Rejects a currently alerting call or disconnects an active call.

: A ''DisconnectCall'' message will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].

:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"DisconnectCall"}}</code>

=== URL Handler ===

On Windows systems, two URI-handler are installed with the myApps platform services. Windows will call up this URI handler when a user clicks on an appropriate link, for example in a web site.

The handler will the send an API message to myApps which passes it to an appropriate API provider (in the cases described here, this will be a ''phone'' or ''softphone'' or ''rcc'' App typically. See [[{{NAMESPACE}}:Concept_myApps#Client_APIs_and_default_apps | Client APIs and default apps]] for more details about this mechanism.

; tel URI : call a number, e.g. <code>tel:4711</code>

: A ''PrepareCall'' message with the ''num'' argument set to the selected text and the ''adjust'' argument set to <code>true</code> will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].
:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"StartCall","num":"4711","adjust":true}}</code>
; sip URI : call a SIP name, e.g. <code>sip:zkl@innovaphone.com</code>

: A ''PrepareCall'' message with the ''sip'' argument set to the selected text and the ''adjust'' argument set to <code>true</code> will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].
:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"StartCall","sip":"zkl@innovaphone.com","adjust":true}}</code>
; im URI : start chat with SIP name, e.g. <code>im:zkl@innovaphone.com</code>

: A ''StartChat'' message with the ''sip'' argument set to the selected text will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.chat/com.innovaphone.chat.htm ''com.innovaphone.chat'' API].
:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.chat","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"StartChat","sip":"zkl@innovaphone.com"}}</code>

On macOS systems myApps might be made the default application to handle tel URI e.g. <code>tel:4711</code> via Apple FaceTime. Open the "FaceTime" menu "Settings..." and select myApps as "Default for phone calls".

On iOS ''tel'' URIs are always dialed via GSM. Therefore myApps iOS also reacts to URI schemes ''com.innovaphone.tel'', ''com.innovaphone.sip'' and ''com.innovaphone.im'', e.g. <code><nowiki>com.innovaphone.tel:4711</nowiki></code>, <code><nowiki>com.innovaphone.sip:zkl@innovaphone.com</nowiki></code>, <code><nowiki>com.innovaphone.im:zkl@innovaphone.com</nowiki></code>.

=== User activity ===
On Windows and macOS systems, the myApps platform services can monitor user keyboard/mouse activity and change the user's presence state after a certain amount of inactivity. The timeout can be specified using the ''advanced settings'' user interface (see [[#UI elements| UI elements]] below.

myApps will then send a [https://sdk.innovaphone.com/doc/appwebsocket/myApps.htm#SetUserActivity''SetUserActivity''] message to the PBX using the ''myApps'' protocol.

: <code>{"mt":"SetUserActivity","inactive":true}</code>

This will change the ''status'' property of the ''im:'' contact for the user's own presence and hence result in a presence update from the PBX to myApps

: <code>{"mt":"UpdateOwnPresence","presence":[{...},{"contact":"im:","activity":"","status":"closed"}]}</code>
The ''closed'' status is reflected in the grey status color when displaying a contact [[Image:myapps-inactive.png|myapps-inactive.png/|myapps-inactive.png/]].

On iOS and Android, the state is set to ''inactive'' as soon as the App is brought to background.
When myApps platform services are not available (i.e. when running the web application in a browser solely) a limited user activity monitoring is available: the state is set to active when the web page is not used for more than 5 minutes.

=== Recording ===

The new launcher offers the possibility to record the audio of incoming and outgoing calls. In order to activate that functionality the URL of the recording instance must be configured in either the PBX (PBX->myApps->Config: Recording URL) or the softphone App (Settings->Audio Recording (URL))

[[Image:PBX-Recording-Settings.png|pbx-recording-settings.png/|pbx-recording-settings.png/]] [[Image:Recording-Softphone-Settings.png|recording-softphone-settings.png/|recording-softphone-settings.png/]].

As long as that URL is configured the audio data of all calls are stored as pcap-files under that URL.
If the URL points to a CF device in the PBX, write access must be granted for that URL (PBX->Services->HTTP->Server:Public compact flash access) and if the URL points to the recording app, the files can be accessed via the recording app [[{{NAMESPACE}}:Concept_App_Service_Recordings|recording]].

Under PBX->myApps the administrator can set a certain default behaviour of the audio recording like whether or not the recording should start automatically at the beginning of the call (Recording by Default ON/OFF), only calls with external numbers should be recorded (Record external calls only) or whether or not the user should be able to start/stop the recording himself (Allow user incall recording control). Except for the last parameter these parameters can also be modified by the user in its softphone settings if the administrator doesn't set the FORCE flag.

If the user was allowed by the admin to control the recording a recording switch is active during the call when the "Media" Panel is opened. There the audio recording may be stopped and continued at will. A red recording notice is shown in the top right corner when the recording actually takes place.

[[Image:Recording-incall-switch.png|recording-incall-switch.png/|recording-incall-switch.png/]]

=== Notifications ===

The myApps platform services can use the OS specific notification mechanism (e.g. ''desktop notifications'' on Windows) to display messages (e.g. ''incoming new chat message'') to the user.

Note that the actual rendering of the notification is under control of the OS. Therefore, myApps must be allowed to show notifications and its appearance can be restricted by OS native settings.

==== Microsoft Windows Notifications ====

Microsoft Windows Server editions (2016, 2019, 2022) are just capable of showing a single ''IncomingCall'' notification at the same time (we couldn't find a workaround for this limitation). 
An ''IncomingCall'' notification is visible the whole time instead of being moved to the action center after a certain time. 
 
A notification about a missed call uses the ''IncomingCall'' type so that this notification is visible until the user returns. 
Due to the above limitation, on a new arriving call such a missed call notification is transformed to a default notification which will be moved to the action center automatically. 
 
On non server editions, you can have multiple IncomingCall notifications at the same time (so two parallel incoming calls will be indeed notified at the same time), but the missed call notification handling is the same on both platforms!

Thus there will be always just '''one''' missed call notification visible and previous missed calls can be found inside your action center!

To see myApps notifications, ensure:
* System -> Notifications
** enable notifications
** disable "Do not disturb" or allow myApps as priority application while "Do not disturb" is active
** enable notifications for myApps in the list of applications
* System -> Focus
** if a focus session is active and the "Do not disturb" is activated during a focus session, make sure that myApps is a priority application (see above)

==== macOS Notifications ====
Notifications are the same as on Windows.
The difference is, that for macOS, notifications need to be allowed in the system settings.
Go to Notifications - myApps, select Banner and enable all check marks.

=== Local phonebook access ===
'''Contact Search:''' The myApps platform services implement an ''API provider'' for the [http://sdk.innovaphone.com/web1/com.innovaphone.search/lib1_api_search.htm ''com.innovaphone.search'' API]]. They perform search capabilities on the OS' local phone books which can be used by Apps like the ''phoneapp''.

Apps would send a ''Search'' request to the API:

: <code>{"mt":"ApiRequest","consumer":"dev:SwPh_zkl_5e42e884","provider":"*","src":"4","msg":{"mt":"Search","type":"contact","search":"john doe"},"apiId":"com.innovaphone.search"}</code>
Search results are delivered as ''SearchInfo'' messages:

: <code>{"mt":"ApiResult","src":"3","provider":"@local-8125d22e37-519d-4056-bfe5-c52ef2ae8fabb0","consumer":"dev:SwPh_zkl_5e42e884","client":"@client-f62702dd86-be3f-47fc-b4bc-7a21627b75b2ea","msg":{"mt":"SearchInfo","relevance":2000,"adjust":true,"type":"contact","contact":{"givenname":"John","sn":"Doe","company":"ACME","position":"Head of everything","telephonenumber":["11111","22222"],"homephone":["+4944444","33333"],"mobile":["+49 (123) 55555"]}},"api":"com.innovaphone.search"}</code>

'''Reverse Lookup:''' The myApps platform services implement an ''API provider'' for the [http://sdk.innovaphone.com/web1/com.innovaphone.phonelookup/lib1_api_phonelookup.htm ''com.innovaphone.phonelookup'' API]. They perform search capabilities on the OS' local phone books which can be used by Apps like the ''phoneapp''.

Apps would send a ''Lookup'' request to the API:

: <code>{"mt":"ApiRequest","consumer":"dev:SwPh_zkl_5e42e884","provider":"*","src":"4","msg":{ mt: "Lookup", prefixIntl: "000", prefixNtl: "00", prefixExt:"0", area: "7031", country: "49", lookup: "0004970311234567" },"apiId":"com.innovaphone.lookup"}</code>

Search results are delivered as ''LookupInfo'' messages:

: <code>{"mt":"ApiResult","src":"3","provider":"@local-8125d22e37-519d-4056-bfe5-c52ef2ae8fabb0","consumer":"dev:SwPh_zkl_5e42e884","client":"@client-f62702dd86-be3f-47fc-b4bc-7a21627b75b2ea","msg":{mt: "LookupInfo", dn: "Jake Blues", contact: { telephonenumber: ["0004970311234567"], givenname: "Jake", sn: "Blues", company: "Blues Brothers" </code>

==== Windows ====
On Windows, the search and lookup are performed in all of the user's Outlook contact folders. As opposed to the search implemented in the ''Contacts'' and ''Users'' App, all items are returned which match any of the search words (i.e. searching for ''a b'' will return items matching either ''a'' or ''b'').

; searched properties : firstname, lastname
; returned properties : Following Outlook contact phone number properties are returned (if available):

:* OFFICE_TELEPHONE_NUMBER as ''telephonenumber''
:* OFFICE2_TELEPHONE_NUMBER as ''telephonenumber''
:* HOME_TELEPHONE_NUMBER as ''homephone''
:* HOME2_TELEPHONE_NUMBER as ''homephone''
:* MOBILE_TELEPHONE_NUMBER as ''mobile''
:* BUSINESS_FAX_NUMBER as ''facsimiletelephonenumber''
Note that contact information is cached in the search provider. Updated contacts may therefore become effective after a while only.
Outlook search will create its own trace file <code>myAppsOutlookSearch-</code>''date-time''<code>.txt</code> in the standard trace directory.

This search provider is always installed and can be disabled. There is no need (nor possibility) to enable it in the ''Apps'' tab of the PBX's user object. Also, no ''App'' object needs to be created for it.

==== Android/iOS ====
The search and lookup are performed in the contacts.

==== macOS ====
The search and lookup are performed in the contacts. If you wish to disable local contact lookup, go to system settings - Security & Privacy and disable the access to contacts for myapps.
=== Microsoft Office integration ===

The myApps platform services has a ''office presence provider'' that can provide the user's presence state to Office applications. See [[{{NAMESPACE}}:Concept_myApps_Office_Integration|myApps Office Integration]] for details.

This feature is installed by default. However, it can be disabled using the ''OFFICEPRESENCE'' MSI Parameter. Also, a check-mark is available in the setup dialog.

=== Call an external application for calls ===

Phone Apps (such as the phoneapp or softphone) can initiate the start of an external application when a new call appears (either incoming or outgoing). The actual spawning of the application is done by the myApps platform service. Also, the application properties (such as e.g. the executable's path) is configured in the myApps platform services (see [[#UI elements|Advanced settings]] in the ''UI elements'' section below).

A number of arguments can be passed to the application by substituting $-variables in the ''Parameter'' field:

; $n : phone number as dialed (called party number for outgoing calls) or received (calling party number for incoming calls)

; $N : called or calling party number in ''national'' format (e.g. 07031730090)

; $I : called or calling party number in ''international'' format (e.g. +497031730090)

: note that both $N and $I only work if $n includes both subscriber number and area code (e.g. 07031730090). Otherwise they are equal to $n

; $d : display name of peer (if known)

; $u : URI name of the peer (if available eg with a federation call)

; $c : conference id

: this is a globally unique ID for this call and may be used to relate the call to the ''guid'' found in the CallInfo structure in the [http://wiki.innovaphone.com/index.php?title=Reference10:SOAP_API#CallInfo SOAP-API] and [http://sdk.innovaphone.com/doc/appwebsocket/RCC.htm RCC-API ]. Also, corresponding [[Reference10:Call Detail Record CDR PBX|CDRs]] can be related using the ''event'' tag's ''conf'' attribute.
The start of an external application can be requested using the ''com.innovaphone.externalapps'' API.

Some setup examples are [[Howto:Integrate External Apps in innovaphone UC clients|shown here]].

=== Push ===

Mobile operating systems usually inhibit network operation of apps which run in the background or are closed by the user. This is done in order to reduce battery consumption. Unfortunately, this also stops such apps to maintain a registration by regularly sending ''keep alive'' messages to a server (in our case to the PBX). As a result, myApps will be disconnected from the PBX. When the PBX determines that there is an event for the application which needs a response, it needs to wake up the app using a dedicated channel provided by the operating system. This mechanism is know as ''push''. When running on iOS or Android, myApps supports ''push''.

For ''push'' to work, a [[{{NAMESPACE}}:PBX/Objects/Push|''push object'']] needs to be configured in the PBX . Also, it needs to be enabled on the mobile phone for the myApps app.
This mechanism is quite similar in v12 and v13, so you can refer to [[{{NAMESPACE}}:Concept_Push_Notifications_for_iOS_and_Android|the concept for push notifications for iOS and Android]] for more details.

Also, helpful hints can be found in [[Howto:Troubleshoot v13 Push with myApps for Android and iOS]].

=== App Proxy ===

myApps runs further ''Apps'' (such as e.g. the ''phoneapp'') as a web page in an IFRAME of the browser myApps is running in. The App's page code is loaded either from the PBX or from an ''application platform'' (AP). This however would mean that the App's IFRAME would remain empty (a dead white screen) when the PBX or AP is not available. To make sure the App can start-up anyway, the myApps platform services feature the so-called ''App Proxy''. This is a caching proxy that caches all the App code so it is available even in case of network failure. When myApps runs in the context of the platform services, Apps are therefore not loaded from the App source directly, but from the local App proxy.

The cached files are stored in the PCs local file system in the <code>%LOCALAPPDATA%\innovaphone\myApps\appproxy</path></code>. There is no configuration required. However, if myApps seems to run with outdated or corrupt cached copies of the App, you can safely delete the entire directory.

=== Auto update ===

On Windows and on macOS, the myApps platform services can auto-update themselves to a common version. This is controlled by the [[{{NAMESPACE}}:PBX/Config/myApps#Launcher_Software_Update | ''Launcher Software Update'']] settings under ''PBX/Config/myApps'' in the PBX.

When myApps is started or the user logs in or myApps needs to re-connect to the PBX, the platform services will use the [http://sdk.innovaphone.com/web1/com.innovaphone.client/lib1_api_client.htm com.innovaphone.client API] to learn the desired version (''launcherUpdateBuild'', which is part of the API's ''model''). If this differs from the current version, the platform services will try to download the respective new version.

{
"mt": "ApiUpdate",
"apis": {
"com.innovaphone.client": {
"@client": {
"title": "innovaphone myApps",
"model": {
"launcher": true,
"launcherUpdateBuild": "134906",
"appStoreUrl": "http://store.innovaphone.com/release/download/"
}
}
}
}
}

The installation of the downloaded version is done by the ''innovaphonemyAppsUpdateService''. This service is installed and enabled during the initial installation of the myApps platform services. To disable auto-update, either leave the ''Launcher Software Update'' settings empty or set the service's start mode to ''disabled'' in the Windows ''services control panel''.

Note that on Windows the update service does not work on terminal servers. Administrators must do myApps base services updates using standard windows mechanisms.

Note that on macOS if myApps has been installed from the Apple Store it is assumed that auto update from the PBX is not desired and disabled therefore. If you need to activate the auto update later, you will need to reinstall myApps using the .pkg file.
On Android/iOS/macOS updates can be downloaded from the respective app store.

The ''Devices'' app can not update software installed on Windows PCs directly. However, when the PBX is updated using an ''update job'' in the ''Devices'' App, the ''Launcher Software Update'' settings will be updated accordingly and hence the myApps base services will ultimately also be updated to the same version.

==== Auto update flow on Windows ====

* On start of myApps, myApps checks if an update is available and ready for installation
** if yes, the update is installed directly, without user interaction (a popup is shown during the installation)
** if not, myApps starts
* if an update is available while myApps is already running, an update notification will be shown which let's the user choose to install the update now or later (the notification will then popup again after one hour)

==UI elements ==
There are a few user interfaces provided by the platform services:
===tray-icon (Windows only) ===
::[[Image:myapps-tray.png|myapps-tray.png/|myapps-tray.png/]]
:Allows to
:* terminate myApps
:* toggle the ''autostart'' state
:* toggle the ''show in task bar'' state
:* open the trace folder
:
=== PBX connect form===
:: [[Image:myapps-connect.png|myapps-connect.png/|myapps-connect.png/]]
: Allows the user to specify the connect data for the PBX (i.e. IP address or DNS name)
:
=== Advanced settings===
[[Image:myapps-settings0.png| More button to access advanced settings]]
<gallery mode="packed" heights="420" style="float:left">
Image:MyApps-settingsNew.png|Advanced generic configuration
Image:MyApps-settingsNew2.png|Hotkeys configuration
Image:MyApps-settingsNew3.png|External launcher configuration
Image:MyApps-settingsNew4.png|Trace configuration
</gallery>
<div style="clear:both;"></div>

: Allows modification of various platform dependent settings (such as the hotkey selection on Windows, external application actions, etc).

== Interfaces ==
=== Provided APIs ===

; [http://sdk.innovaphone.com/web1/com.innovaphone.search/lib1_api_search.htm com.innovaphone.search] : access to local phone book entries by the [[#Local phonebook access|Local phonebook access]] component.
; [http://sdk.innovaphone.com/web1/com.innovaphone.launcher/com.innovaphone.launcher.htm com.innovaphone.launcher] : display of OS specific user notifications and receipt of related user actions
; com.innovaphone.notificationhandler : reports back click on a notification.
; com.innovaphone.externalapps : to start external applications, see [[#Call an external application for calls|Call an external application for calls]] above

=== Used APIs ===

; [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm com.innovaphone.phone] : used to initiate new or manipulate existing calls by the [[#Hot keys|Hot keys]] and [[#URL handler|URL handler]] components.

; [http://sdk.innovaphone.com/web1/com.innovaphone.chat/com.innovaphone.chat.htm com.innovaphone.chat] : used to start a new chat by the [[#URL handler|URL handler]] component.

; [http://sdk.innovaphone.com/web1/com.innovaphone.client/lib1_api_client.htm com.innovaphone.client] : the model is used to learn the update settings, see [[#Auto update|Auto update]] above

=== Protocols ===

; [https://sdk.innovaphone.com/doc/launcher/Media.htm Media Protocol] : used by apps to allocate RTP channels, see [[#RTP service for audio.2C video and data|RTP service for audio, video and data]] above

== Related App Services ==

none

== Known limitations ==
; Incoming call as banner on myApps for iOS : Since iOS 14 the iOS CallKit presents incoming calls as a banner leaving the original green answer button of myApps visible. Use only the blue button of the banner to accept the call or change iPhone Settings, App "Phone", "Incoming Calls" to "Full Screen" to hide the myApps user interface again during call answering.

; Call answer in speakerphone mode even with active Bluetooth headset on myApps for iOS : This causes unwanted speakerphone operation if the smartphone is used with a Bluetooth car audio system. The behaviour can be changed by selecting ''Bluetooth Headset'' in this setting:
:''iOS Settings->Accessibility->Touch->Call Audio Routing: Automatic / Bluetooth Headset / Speaker''
:''iOS Einstellungen->Bedienungshilfen->Tippen->Anrufaudioausgabe: Automatisch / Bluetooth-Headset / Lautsprecher''

; Windows Server 2016 (Windows 10 Build 1607) : windows just shows the first notification. Further notifications aren't displayed until the previous ones are removed from the notification center. Current windows builds do not show this behaviour anymore.

; Problems on Mac computers with Yealink USB headsets
: we have received reports that myApps quits unexpectedly on some Mac computers when a Yealink headset is plugged in. Unfortunately, we could not find out the cause yet. If you use Yealink USB headsets and have a similar issue, please open a support ticket and send myApps traces.

; Poly / Plantronics headset buttons only functional if myApps is started with Rosetta
: myApps macOS supports Apple M1/M2 hardware natively. However, the Poly / Plantronics headset SDK is only available for Intel platform and thus myApps needs to be started via Apple's Intel emulator Rosetta if a Poly / Plantronics headset is used. This is done with right-click on the myApps executable, ''Information'', ''Open with Rosetta''.

; Windows surface devices may not work correctly
: Chromium does not get touch keyboard events. USB Keyboards may not be recognized either.

= Installation =

== Windows ==

myApps platform services are installed on Windows using the .msi file found in the ''myApps Windows'' package from [https://store.innovaphone.com/release/download.htm store.innovaphone.com].

myApps can update itself automatically, see [[#Auto update|Auto update]] above.

=== MSI Parameters and install options ===

The MSI installer of myApps for Windows supports the following parameters and can be edited with [https://docs.microsoft.com/en-us/windows/win32/msi/orca-exe Microsoft Orca]. You can add your parameters in the table ''property''.

; SERVER (REG_SZ): the PBX's server address (without protocol like https://)
; OFFICEPRESENCE (REG_DWORD): '''false''' to disable presence integration in Microsoft Office
: this is also available as a check-mark when running the install manually

; DISABLEHEADSETS (REG_DWORD): '''true''' to disable headsets support, see [[#Device handling|Device handling]] above

; EXTERNALAPPS (REG_SZ): pre-define external applications, see [[#Call an external application for calls|Call an external application for calls]] above
: e.g. <code>"{""externalApps"":[{""id"":0,""name"":""Wireshark"",""path"":""C:\\Program Files\\Wireshark\\Wireshark.exe"",""param"":""test $I""}]}"</code>

; FORCERESTART (REG_DWORD): '''true''' (or any string ...) kills myApps during the installation and restarts it for the currently logged in user, if it was running

; DISABLELOCALHOST (REG_DWORD): '''true''' to disable use of '''localhost''' string to access the local webserver. Use '''127.0.0.1''' instead

; EXCLUDEINTERFACES (REG_SZ): some VPN interfaces are not detected by Windows as IF_TYPE_PPP or IF_TYPE_TUNNEL and therefore the '''media outside VPN''' setting is not taking effect. With this option interfaces can be pre-defined that will not be used for media. Interfaces must be comma separated
: e.g. <code>EXCLUDEINTERFACES="172,192.168,10.10"</code>

; FASTERDOWNLOADS (REG_DWORD): '''true''' to have faster downloads without artificially slowing down the download of an update (which is done to avoid audio lags if clients have slow networks).

Current settings are stored in the registry at <code>Computer\HKEY_CURRENT_USER\Software\innovaphone\myApps</code> or at <code>Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\innovaphone\myApps</code>

Boolean values like OfficePresence are stored in registry entries with type REG_DWORD and values 1 or 0. 0 disables the setting and 1 enables it.

== iOS ==

myApps platform services are installed on iOS by loading ''innovaphone myApps'' from the ''App Store''.

=== Configuration via MDM ===

the PBX's server URL can be pre-configured by specifying this dictionary in the MDM
<plist>
<dict>
<key>server</key>
<string>pbx.example.com</string>
</dict>
</plist>

== macOS ==

myApps platform services might be installed directly from the Apple store. An installer package <code>myapps.pkg</code> and a disk image <code>myapps.dmg</code> is also available from the innovaphone app store. Install <code>myapps.pkg</code> by double-click on the file and follow the instructions of the installer. myApps becomes available in the Applications folder and can be opened by double-click. Or download and open <code>myapps.dmg</code> and double klick myApps. If desired integrate it into the app dock by right click, ''Options, Keep in the dock''.

If installed from the innovaphone app store, myApps can update itself automatically, see [[#Auto update|Auto update]] above.

If installed from the Apple store, macOS notifies about updates on the Apple store. myApps [[#Auto update|Auto update]] is disabled then.

If a clean-install of the client is necessary, the folder "/Users/username/Library/Containers/myapps" needs to be deleted. To be on the safe side also delete it from the trash bin.

=== Configuration via MDM ===

the PBX's server URL can be pre-configured by specifying this dictionary in the MDM
<plist>
<dict>
<key>server</key>
<string>pbx.example.com</string>
</dict>
</plist>

=== Preferences ===

macOS supports preference settings that can be set via a shell command or via Mac remote management

defaults write com.innovaphone.client-ios-14r1 server "PBX-server-URL"

The following parameters and can be set through this method:

; server: the PBX's server URL

=== Setting myApps as Default App for SIP-URLs ===

{| class="wikitable"
|defaults write com.apple.LaunchServices/com.apple.launchservices.secure LSHandlers -array-add '{
LSHandlerURLScheme = sip;
LSHandlerRoleAll = "<CFBundleIdentifier>";
}'
|}

To find the “CFBundleIdentifier”, proceed as follows:
* In the Finder under “Applications”, search for the desired myApps client that you want to set as the default app.
* Right-click on “Show package contents” -> you will find the “CFBundleIdentifier” in the Info.plist file.

A restart of the MAC is required.

=== Using Sennheiser headsets ===
If you use Sennheiser headsets, you should also install the then-current <code>DSEA_SDK_v</code>''version''<code>.pkg</code> package, after you installed the myApps client. Without that, audio will still work, but not the controls on the headset. You will need to keep that up-to-date yourself, as it is not updated by myApps's auto-update function.

== Android ==

myApps platform services are installed on Android by loading ''innovaphone myApps'' from the ''Play Store''.

=== Configuration via MDM ===

the PBX's server URL can be pre-configured by specifying a property "server" with string value "pbx.example.com" in the MDM.

== IP270 ==
For configuration instructions, refer to the [[Reference16r1:Concept IP270|IP270 concept article]].

= Configuration =

== Server configuration ==
When opening myApps for the first time, the user is prompted for the Server. Usually only the hostname (DNS host name or IP address) needs to be configured.

But there are more options for special PBX configurations.

; Non-standard HTTPS port
: If the PBX uses a non-standard HTTPS port, it must be appended to the host name separated by a colon (<code>:</code>).
: Example: <code>pbx.example.com:4444</code> (expands to <code>https://pbx.example.com:4444/PBX0/APPCLIENT/appclient.htm</code>)
; DynPBX module name
: If the PBX is a DynPBX, the module id must be appended to PBX0 separated - (<code>/</code>).
: Example: <code>pbx.example.com/PBX0-1</code> (expands to <code>https://pbx.example.com/PBX0-1/APPCLIENT/appclient.htm</code>)
; Softphone physical location
: If user defined physical location shall be used for softphone, you can append it using a parameter <code>#phys=</code>.
: Example: <code>pbx.example.com#phys=slave</code> (expands to <code>https://pbx.example.com/PBX0/APPCLIENT/appclient.htm#phys=slave</code>)

Example 1: PBX pbx.example.com with standard configuration
pbx.example.com

Example 2: PBX slave.example with DynPBX module ID 1, HTTPS port 4444 and physical location master
slave.example.com:4444/PBX0-1#phys=master

=== HTTP proxy support ===

myApps platform services do support operation via HTTP proxy now. If one or more proxies have been configured in the network settings of the operating system for the active network connection, HTTP CONNECT tunnels are established.

On Windows user name and password can be specified for the tunnel servers as generic credentials in the credentials manager (Anmeldeinformationsverwaltung). The name of the credentials must be the tunnel server hostname.

On Android user name and password can be specified through Android ''Settings, Accounts'' by adding a myApps ''HTTP Proxy Credentials'' account. The name of the account must be the tunnel server hostname.

== Platform specific settings ==
When myApps runs under the myApps platform services, it will show various platform specific settings as part of its ''burger menu'', so the user can set them. See ''Advanced settings'' in [[#UI elements|UI elements]] above.

Some options can also be set globally for all myApps clients in the PBX's [[{{NAMESPACE}}:PBX/Config/myApps#Client_Settings|PBX/Config/myApps ''Client Settings'']]
{|
! style="text-align: left; font-weight: bold" | Option

! style="text-align: left; font-weight: bold" | Description

! style="text-align: left; font-weight: bold" | Where to set

!
! style="text-align: left; font-weight: bold"| Availability
|-

| || || User menu || PBX ''Client Settings'' || Windows || iOS || Android || macOS
|IP270<ref>myApps-IP270 offers device specific settings explained in [[Reference16r1:Concept IP270|IP270 concept article]]</ref>
|-
| Autostart || Launch myApps on login || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Appear offline after || controls after which idle time a user is considered ''inactive''. See [[#User activity|User activity]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Hotkeys || Hotkeys for call dial, accept, reject. See [[#Hot keys|Hot keys]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Docking || Docking mode (left, right, none). See [[#???|??]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✗
|✗
|-

| Desktop notifications|| Turn on/off platform notifications. See [[#Notifications| Notifications]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| VPN || Disable VPN address for ICE candidate selection. See [[#RTP ports| RTP ports]] above || ✔ ||✔ ||✔ || ✗ || ✔ || ✔
|✗
|-

| Show in taskbar|| Show myApps in the taskbar in addition to it's tray icon. || ✔ ||✗ ||✔ || ✗ || ✗ || ✗
|✗
|-

| Log flags || turn on/off certain trace levels. See [[#Troubleshooting|Troubleshooting]] below. || ✔ ||✔ ||✔ || ✔ || ✔ || ✔
|✔

|-

| External applications || define the applications available for Apps to be started. See [[#Call an external application for calls|Call an external application for calls]] above. || ✔ ||✗ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Ring in headset || send ring tone for incoming to headset instead of loudspeaker. || ✔ ||✗ ||✔ || ✗ || ✗ || ✗
|✗
|}
<references/>

== Start parameters for Windows ==

On Windows, it is not possible to pass start parameters from the [https://www.chromium.org/developers Chromium documentation] to the myApps process.

== OS Settings for Windows ==
Windows settings can influence the display of ''Desktop notifications''. See [https://support.microsoft.com/en-us/help/4028678/windows-10-change-notification-settings Change notification settings in Windows 10/11] for details.

=== Windows 11 ===

* Windows 11 has a feature "do not disturb". This hides notifications if enabled.
* Windows 11 has a feature "focus". This enables "do not disturb" and thus hides notifications too.
* Windows 11 has priority settings for notifications. Ensure that VoIP notifications for calls are allowed any maybe also include myApps as an App which is allowed to show notifications.

== OS settings for Android ==
; Events : The appearance of notifications can be controlled here.

; Call accounts : For proper incoming call signaling, the call account ''myApps'' needs to be enabled. Note that on Samsung smartphones the call account switch likely toggles back and a few tries may need to be done until it persists. Please double-check the state.

; Preferred Calling Account : Choose which calling account (myApps/SIM/..) should be used for outgoing calls initiated from within the native phone app / phone book.

; Background data, unlimited data usage : Grant background data use to enable ''myApps'' to connect to the PBX immediately on an incoming call.

; Overlaying : This setting is not needed if call account ''myApps'' has been enabled. Should there be a reason for not enabling call account ''myApps'', the permission for overlaying needs to be granted on Android 10 or higher for proper call signaling. On Android 17 overlaying (navigate to ''Settings'', select ''Apps'', tap ''Special app access'' (or the menu icon), choose ''Display over other apps'') might show ''deactivated''. Navicate and click ''Android Settings -> Apps -> myApps -> 3 dots menu -> Enable restricted settings'' to release this deactivation and then grant the permission.

Note: If no SIM card is installed some Android smartphones exhibit a problem dialing from the smartphone contacts. The contacts app shows a choice ''Select SIM card for this call'' but all possible dialers are greyed out. In this case make myApps the default phone app in Android settings ''Apps, Default apps, Telephony''.

== OS settings for iOS ==
; Notifications : The appearance of notifications can be controlled in iOS ''Settings, myApps''.

== OS settings for macOS ==

; Notifications : The appearance of notifications can be controlled in macOS ''Preferences, Notifications, myApps''.

=Troubleshooting=

myApps platform services can write various traces for debugging. Trace can be turned on and off selectively in the [[#Advanced settings|Advanced settings]].

The following trace flags can be set:

(''Recommended trace options are: '''App, Browser, ICE, TURN, Signaling and Audio'''. Please do not activate other flags unless innovaphone support says otherwise'')

{|
!style="text-align: left; font-weight: bold" | Abbreviation

!style="text-align: left; font-weight: bold" |code

!style="text-align: left; font-weight: bold" | description

|-
| App||0x000000001|| logs from the App Service itself
|-
| DNS||0x000000008|| logs DNS requests and results
|-
| HTTP client||0x000000080|| http client logs
|-
| TLS||0x000000400|| TLS logs
|-
| TCP||0x000000800|| TCP logs
|-
| LDS||0x000001000|| local domain sockets
|-
| WebSocket client||0x000004000|| logs outgoing websocket connections
|-
| App WebSocket||0x000008000|| logs app websocket connections (e.g. from PBX objects to an App Service or from the UI to the App Service)
|-
| UDP||0x000200000|| UDP logs
|-
| DTLS||0x000400000|| logs DTLS handshake and messages
|-
| Media||0x000800000|| logs media events
|-
| Media channel||0x001000000|| logs RTP/SCTP media connections
|-
| ICE||0x002000000|| logs ICE messages between peers
|-
| TURN||0x004000000|| logs TURN messages between peers
|-
| AppSharing||0x008000000|| logs AppSharing connection
|-
| Audio||0x010000000|| logs Audio connection and headset events
|-
| Video||0x020000000|| logs video connection and webcam events
|-
| Browser||0x040000000|| logs Chromium events
|-
| AppProxy||0x080000000|| logs requests which are proxied between the local webserver and the remote server
|-
| Webserver ||0x200000000|| enables webserver specific logs
|-
| Browser Console ||0x400000000|| logs browser console events
|-
| Signaling||0x800000000|| enables logs in the signaling module for debugging calls
|}
''code'' can be or'ed and used as value for the ''Log flags'' field in [[{{NAMESPACE}}:PBX/Config/myApps#Client_Settings|PBX/Config/myApps/Client Settings]].

== Windows ==
On Windows, traces are written to the <code>%LOCALAPPDATA%\innovaphone\myApps</code> directory. If you start myApps with --log-size as parameter, you can define the maximum size of a log file (e.g. --log-size=100000000 would be 100MB for each file)

:* myApps-''date-time''.txt : main log file for the platform services

:* myAppsOutlookSearch-''date-time''.txt : log file for the Outlook phone book access

:* myAppsHookController-''date-time''.txt : log file for the hot-key interceptor (see [[#Hot keys|Hot keys]])

; :myApps update installation traces are written to the <code>%windir%\temp\</code> directory.
:* myAppsInstall.txt: MSI installation file

; :myApps update service traces are written to the <code>%ProgramData%\innovaphone\myAppsUpdateService</code> directory.
:* myAppsUpdateService-''date-time''.txt: myApps update service traces

==Android==
traces can be sent by e-mail.

Also, an Android device might also be connected to a PC via an USB cable to get the traces. The files can be found in <code>Android/data/com.innovaphone.clientandroid/files</code>

== iOS ==
traces can be sent by e-mail.

== macOS ==
traces can be sent by e-mail.

Also, files can be found in <code>~/Library/Containers/com.innovaphone.client-ios/Data/Documents/</code>. Press ''Alt+N'' followed by space to get tilde ''~''.

== IP270 ==
Refer to the [[Reference16r1:Concept IP270#Troubleshooting|IP270 concept article section troubleshooting]].

= Known Problems =
[[:Category:Problem myApps platform services|Known Problems]]

= Related Articles =
* [[{{NAMESPACE}}:Concept_myApps]]
* [[{{NAMESPACE}}:Concept_myApps_Redundancy|Concept myApps Redundancy]]
* [[{{NAMESPACE}}:Concept_myApps_Office_Integration|Concept myApps Office Integration]]
* [[{{NAMESPACE}}:Concept_myAPPs_Search_in_local-Outlook_Contacts|Concept myAPPs Search in local Outlook Contacts]]
* [[{{NAMESPACE}}:Call_Detail_Record_CDR_PBX|Call Detail Records]]
* [[{{NAMESPACE}}:Concept Push Notifications for myPBX iOS and Android|Concept Push Notifications for myPBX iOS and Android]]
* [[Howto:Troubleshoot v13 Push with myApps for Android and iOS]]
* [[{{NAMESPACE}}:PBX/Config/myApps|Reference16r1:PBX/Config/myApps]]
* [[{{NAMESPACE}}:Concept_IP270|IP270 concept article]]
[[Category:Concept myApps platform services]]

Reference16r1:Concept myApps platform services

2026-08-23T10:22:27Z

Tmo: /* OS settings for Android */

[[Category:Concept|myApps]]

myApps platform services provide various operating system specific services which can be used by other ''Apps'' running in the [[{{NAMESPACE}}:Concept myApps|myApps client]]. Those services typically are not available in the browser's JavaScript environment and hence must be implemented in native platform code. Therefore, the platform services are installed as native executable on the respective platform.

When myApps is started in a web browser (and hence has no access to the platform services), some Apps will use [https://en.wikipedia.org/wiki/WebRTC WebRTC] services implemented by the browser instead. For ease of reference, features available in this scenario are also described here.

On windows, the platform services also come with their own web browser in which the myApps web App will be started then. This browser is based on google's [https://en.wikipedia.org/wiki/Chromium_(web_browser) Chromium] open source software.
= Applies To =

* [[{{NAMESPACE}}:Concept myApps|myApps]]
* myApps for Windows
* myApps for macOS
* myApps for iOS
* myApps for Android
* myApps Web App (WebRTC)
* myApps for IP270
version 16r1

=Features=
Not all features are available or required on all platforms.
{|
! style="text-align: left; font-weight: bold" | Feature
! style="text-align: left; font-weight: bold" | Description
! style="text-align: left; font-weight: bold"| Availability
|-
| || || Windows || iOS || Android || macOS || Browser<ref>This refers to the myApps web application running in a browser with no platform services available</ref>
|IP270
|-
| [[#Device handling|Audio Devices]]|| manage local audio devices to record and playback audio conversations || ✔ || ✔ || ✔ || ✔ || ✔<ref>audio available but devices managed by web browser</ref>|| ✔
|-
| Video || manage local displays and cameras to capture and render video live stream || ✔ || ✔ || ✔ || ✔ || ✔<ref>video available but devices managed by web browser</ref>|| ✔
|-
| Ringer || manage local ringing device || ✔ || ✔ || ✔ || ✔ || ✔ || ✔
|-
| [[#Application sharing|Application sharing]]
|-
|   presenter || share an application || ✔ || ✗ || ✔ || ✔ || ✔ || ✔
|-
|   consumer || view an application shared by the peer || ✔ || ✔ || ✔ || ✔ || ✔ || ✔
|-
| [[#Hot keys|Hot keys]]|| capture key presses for quick invocation of phone apps (e.g. dial selected number) || ✔ || ✗ || ✗ || ✔ || ✗ || ✗
|-
| [[#URL Handler|tel: and sip: URI handler]]|| intercept clicks on tel: and sip: links in web sites to invoke phone apps || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| [[#User activity|User activity]]|| set presence state according to user activity || ✔ || ✗ || ✗ || ✔ || ✔<ref>limited, see [[#User activity|User activity]] below</ref> || ✔
|-
| Docking || myApps can be docked persistently to the right or left edge of your screens || ✔ || ✗ || ✗ || ✗ || ✗ || ✗
|-
| Multi-windowing || Apps can be launched in separate windows|| ✔ || ✗ || ✗ || ✔ || ✗ || ✗
|-
| [[#Recording|Recording]]|| Calls can be recorded to recording app|| ✔ || ✔ || ✔ || ✔ || ✗ || ✔
|-
| [[#Notifications|Notifications]]|| ||
|-
|   display notifications || display notifications with OS standard mechanism || ✔ || ✔ || ✔ || ✔ || ✔ || ✗
|-
|   push notifications || receive push notifications while myApps is not running || ✗ || ✔ || ✔ || ✔ || ✔<ref>The browser needs to be running in order to receive push notifications.</ref> || ✗
|-
|   chat and apps || display notifications for chat and other apps || ✔ || ✔ || ✔ || ✔ || ✔ || ✗
|-
|   calls || display notifications for incoming calls || ✔ || ✔ || ✔ || ✔ || ✗<ref>Call notifications are only displayed locally while the phone or softphone app is started.</ref> || ✗
|-
| [[#Local phonebook access|Local phonebook]]|| access local phone book || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| [[#Microsoft Office Integration|Office presence provider]]|| maps PBX presence state to Microsoft office presence state || ✔ || ✗ || ✗ || ✗ || ✗ || ✗
|-
| [[#Call an external application for calls|External application start]]|| start arbitrary external applications for calls || ✔ || ✗ || ✗ || ✔ || ✗ || ✗
|-
| [[#App Proxy|App Proxy]]|| a caching proxy that provides app persistence || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| [[#Auto update|Auto update]]|| automatically updates myApps platform services to the same version the PBX has || ✔ || ✔ || ✗ || ✔ || ✔<ref>The then-current web app is always loaded from the PBX upon startup and hence up-to-date by definition</ref> || ✔
|-
| Three party conference || initiate 3-pty-conference using Softphone-App || ✔ || ✔ || ✔ || ✔ || ✗ || ✔
|-
| Exclude VPN || disable use of VPN connections for audio and appsharing || ✔ || ✔ || ✔ || ✔ || ✗ || ✗
|-
| Screen lock || myApps screen lock against unauthorised use || ✗ || ✗ || ✗ || ✗ || ✗ || ✔
|}

<references/>

=Requirements=
* innovaphone PBX 16r1 and up

== Hardware ==
Recommended hardware requirements
* Processor: Dual-core 2Ghz or higher
* RAM: 4 Gb

== myApps for Windows ==
* Windows 11 and up
* Windows Server 2016 and later versions

=== 32 & 64 bit Windows ===
* 32 bit Windows: install the myAppsSetup32.msi from the App Store
* 64 bit Windows: install the myAppsSetup.msi from the App Store
** the 64 bit variant still installs into Program Files (x86), as the main myApps.exe is still a 32bit application
** the 64 bit variant just contains an additional 64 bit binary for the outlook search

=== Windows N editions ===

Windows N editions are missing the ''Media Feature Pack'' which is pre installed on other Windows versions.

Please install the pack from [https://www.microsoft.com/en-us/software-download/mediafeaturepack Microsoft (Windows 10 pack)] before you install myApps. The installer will check if the file <code>C:\Windows\SysWOW64\mfplat.dll</code> exist on your system.

Make sure to install the correct pack depending on your Windows version! There are different packs for Windows 10 1703, 1803, 1809 and 32bit or 64bit etc.

NB: Sometimes the myApps installation will not work even though the media pack is already installed. This is because the installer has no read access to check if the package is already installed. If the above-mentioned file exists and the installer asks to install the Windows Media Feature Pack nevertheless, you have to start the myApps install with administrative rights.

=== Terminal Server environments ===

Audio driver was removed if myApps discovers that it is running in a terminal server environment like Citrix.

The audio driver is needed for the Softphone App but the Softphone App should not use an audio driver at the server side because the audio devices are plugged locally and there would be a delay sending and receiving audio data with the server.

If a customer wants to use the Softphone App at the server side he needs to make use of the myApps Plugin for virtual desktops solution:

[[{{NAMESPACE}}:MyApps_Plugin_for_Virtual_Desktops|Reference15r1:MyApps_Plugin_for_Virtual_Desktops]]

== myApps for macOS ==
* macOS 13 or higher

== myApps for iOS ==
* iOS 16 or higher

== myApps for Android ==
* Android 13 or higher.

== myApps for IP270 ==
Exclusively used in IP270.

= Licenses =
* No license needed for myApps platform services

= Overview =
myApps platform services is a native executable that is installed using the standard mechanisms on the respective operating system. It provides various advanced services which can be used by the myApps web client code as well as the Apps running in the myApps context.

Also, on Windows, the platform services come with their own, dedicated browser to run myApps in. This browser is based on [https://en.wikipedia.org/wiki/Chromium_(web_browser) Chromium]. On iOS, macOS and Android, it is based upon native embedded web view facilities (such as WKWebView) instead.
== Components ==

=== RTP service for audio and appsharing ===
The RTP service provides audio and appsharing as a video stream. VoIP RTP endpoints (e.g. for softphones). It supports STUN, TURN, ICE, SRTP, DTLS. Note however that unlike WebRTC, these endpoints do not ''require'' ICE and DTLS. In other words, they can communicate also with non-compliant (i.e. older) VoIP devices.

Note that the available capabilities when not running the myApps platform services depend on the used browser's WebRTC implementation. See your browser documentation for details.

Apps can request RTP channels using the [https://sdk.innovaphone.com/doc/launcher/Media.htm Media Protocol]'s ''AllocChannel'' message.

==== RTP ports ====
{|
| audio || 50000 -> 50099
|-
| video (app sharing) || 50100 -> 50199
|}

The RTP service will enumerate all local interfaces and create local HOST candidates for ICE. There is an option however to disregard VPN interfaces (more precisely such interfaces with type of ''IF_TYPE_PPP'' or ''IF_TYPE_TUNNEL''). This can eliminate quality issues when RTP data is transmitted through TCP based VPN tunnels.

SRFLX and RELAY candidates are obtained using the STUN and TURN server configuration passed by the App (e.g the ''softphone'' App) as part of the ''AllocChannel'' request.
<code>{"mt":"AllocChannel","channel":"81429cba-396d-43de-8a76-ec020ba8796e","iceServers":[{"urls":"turn:myturn.domaincom:4077?transport=udp","username":"turnuser","credential":"pwd","credentialType":"password"},{"urls":"stun:mystun.domain.com:4077"}],"dn":"Foo Bar","type":"RemoteRtp","kind":"video"}</code>

==== Codecs ====
The installed myApps launchers provide codecs that can be used by softphone apps for media streams. When running in a web browser the codecs depend on the browser version and operating system. See the documentation of your browser for details.

The following codecs are supported:
{|
!style="text-align:left;width:200px;"|Codec
!style="width:100px"|Windows-Launcher
!style="width:100px"|Android
!style="width:100px"|iOS
!style="width:100px"|macOS
!style="width:100px"|Firefox (Browser)
!style="width:100px"|Chrome (Browser)
!style="width:100px"|Edge (Browser)
!style="width:100px"|Safari (Browser)
!style="width:100px"|Opera (Browser)
!style="width:100px"|IP270
|-
|style="text-align:left; background-color:lightgray" colspan="11"|Audio
|
|-
|G711A
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|G711u
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|G722
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|G729 (since 15r1sr16/16r1sr4)
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|[https://caniuse.com/#search=Opus OPUS-NB]
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|[https://caniuse.com/#search=Opus OPUS-WB]
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
| colspan="11" style="text-align:left; background-color:lightgray" |Video
|
|-
|[https://caniuse.com/#search=VP8 VP8]
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|-
|[https://caniuse.com/#search=VP9 VP9]
|style="color:green;text-align:center"|✔**
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔**
|-
|[https://caniuse.com/#search=H264 H264]
|style="color:green;text-align:center"|✔**
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|style="text-align:left; background-color:lightgray" colspan="11"|Application Sharing
|
|-
|Share
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|Watch
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔*
|style="color:green;text-align:center"|✔*
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔*
|}

''* small presentation only'' 
''** only for 1:1 calls, not for conferences

==== Video capture ====
The default resolution for video capture is 1920x1080 if available. Otherwise, 1280x720, 640x480, 352x288 or 320x240 will be used. The frame rate is 30 fps if available, otherwise 15 fps. The resulting average bandwidth could reach 1 Mbps.

==== Application sharing ====
Screen content will be transmitted as video stream by the presenter

==== Device handling ====
The RTP service enumerates microphones, loudspeaker, cameras and ringing devices and notifies apps when devices come and go. It is up to the apps using the devices to store preferences.

The RTP service also enables some extended features (such as hook switch or volume control) for supported USB headsets or Bluetooth headsets connected to myApps.
The supported headset-SDKs determine which headset vendors are recommended to be used with the myApps softphone app. 

For this to work, the following vendor specific development kits are integrated in our myApps client. Be aware that the SDK are updated within our Service release :

{| class="wikitable"
|-
! SDK Vendor !! Supported OS !! SDK Version !! innovaphone Service Release
|-
| Jabra|| MacOS || 1.16.4.0 || 14r2sr11
|-
||| Windows || 1.16.4.0 || 15r1sr3
|-
| Epos ''(formerly Sennheiser)'' || MacOS || 12.4.0.5478 || 14r1sr3
|-
||| Windows || n.a. - [[Support:13r3 sr10 MyApps Windows Client - Epos/Sennheiser-Headsets require installed Epos-Connect Software|to be installed separately]]|| 13r3sr10
|-
| Poly ''(formerly Plantronics)'' || MacOS || 3.25.53799.37131 || 13r3sr9
|-
||| Windows || 3.25.53800.37131 || 13r3sr10
|-
| Yealink || MacOS || 3.1.1.23 || 14r2sr1
|-
||| Windows || 3.1.1.23 || 14r2sr2
|}

Notes:
* It is possible to inhibit the start of the Sennheiser SDK (SenncomSDK.exe) using the <code>DISABLEHEADSETS</code> directive of the installer (see [[#MSI Parameters and install options| MSI parameters]] below).

* Starting with V13r3sr10, the Epos-SDK needs to be installed separately using the Epos Connect software to ensure full compatibility between current Epos headset models and native myApps-Windows client. For details [[Support:13r3 sr10 MyApps Windows Client - Epos/Sennheiser-Headsets require installed Epos-Connect Software|refer to this article]].


myApps-IP270 supports use of [[Reference9:Concept USB Headset|USB devices known for innovpahone desk phones]].

==== Ring tones ====
Ring tones can be played. Apps can choose the tone from a pre-defined list of ring tones.

On Windows, custom ring tones can be uploaded as .mp3 files to the <code>ringtones</code> sub-directory of myApps' roaming directory (which usually is in <code>%appdata%\innovaphone\myApps\ringtones</code>).

On Android, custom ring tones can be added to the system via Android settings.

On iOS, custom ring tones can be uploaded as .mp3 files to the <code>Ringtones</code> subdirectory of the myApps file share that is available in iTunes if the iPhone has been connected via USB.

On macOS, custom ring tones can be uploaded as .mp3 files to <code>~/Library/Containers/com.innovaphone.client-macos/Data/Documents/Ringtones</code>.

==== Debugging ====
For extended debugging, turn on the ''Audio'', ''Media'' and ''AppSharing'' traces in myApps.
=== Hot keys ===
On Windows and macOS systems, myApps platform services can listen for hot keys and invoke certain functions. Invocation is done by sending API messages to myApps which passes it to an appropriate API provider (in the cases described here, this will be a ''phone'' or ''softphone'' or ''rcc'' App typically. See [[{{NAMESPACE}}:Concept_myApps#Client_APIs_and_default_apps | Client APIs and default apps]] for more details about this mechanism.

The hot keys can be specified using the ''advanced settings'' user interface (see [[#UI elements| UI elements]] below. Any of the function keys F1 to F11 (optionally combined with up to two modifier keys ''alt'', ''ctrl'', ''shift'' or ''win'') can be chosen for each function. If you do not want to start the call with "Hotkey+Enter" because you would have to wait for the focus, the hotkey can also be pressed twice and the number is dialled directly.

; dial selected number : Initiates a call using the currently selected text as target.

: A ''PrepareCall'' message with the ''text'' argument set to the selected text and the ''adjust'' argument set to <code>true</code> will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].

:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":"mt":"PrepareCall","text":"13","adjust":true}}</code>

; accept call : Accepts a currently alerting call.

: A ''ConnectCall'' message will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].

:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"ConnectCall"}}</code>

; reject/disconnect call : Rejects a currently alerting call or disconnects an active call.

: A ''DisconnectCall'' message will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].

:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"DisconnectCall"}}</code>

=== URL Handler ===

On Windows systems, two URI-handler are installed with the myApps platform services. Windows will call up this URI handler when a user clicks on an appropriate link, for example in a web site.

The handler will the send an API message to myApps which passes it to an appropriate API provider (in the cases described here, this will be a ''phone'' or ''softphone'' or ''rcc'' App typically. See [[{{NAMESPACE}}:Concept_myApps#Client_APIs_and_default_apps | Client APIs and default apps]] for more details about this mechanism.

; tel URI : call a number, e.g. <code>tel:4711</code>

: A ''PrepareCall'' message with the ''num'' argument set to the selected text and the ''adjust'' argument set to <code>true</code> will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].
:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"StartCall","num":"4711","adjust":true}}</code>
; sip URI : call a SIP name, e.g. <code>sip:zkl@innovaphone.com</code>

: A ''PrepareCall'' message with the ''sip'' argument set to the selected text and the ''adjust'' argument set to <code>true</code> will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm ''com.innovaphone.phone'' API].
:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.phone","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"StartCall","sip":"zkl@innovaphone.com","adjust":true}}</code>
; im URI : start chat with SIP name, e.g. <code>im:zkl@innovaphone.com</code>

: A ''StartChat'' message with the ''sip'' argument set to the selected text will be sent to the [http://sdk.innovaphone.com/web1/com.innovaphone.chat/com.innovaphone.chat.htm ''com.innovaphone.chat'' API].
:: <code>{"mt":"ApiRequest","apiId":"com.innovaphone.chat","consumer":"@local-ae2fc2ab74-3f1e-4ab9-b215-d42f213520317","msg":{"mt":"StartChat","sip":"zkl@innovaphone.com"}}</code>

On macOS systems myApps might be made the default application to handle tel URI e.g. <code>tel:4711</code> via Apple FaceTime. Open the "FaceTime" menu "Settings..." and select myApps as "Default for phone calls".

On iOS ''tel'' URIs are always dialed via GSM. Therefore myApps iOS also reacts to URI schemes ''com.innovaphone.tel'', ''com.innovaphone.sip'' and ''com.innovaphone.im'', e.g. <code><nowiki>com.innovaphone.tel:4711</nowiki></code>, <code><nowiki>com.innovaphone.sip:zkl@innovaphone.com</nowiki></code>, <code><nowiki>com.innovaphone.im:zkl@innovaphone.com</nowiki></code>.

=== User activity ===
On Windows and macOS systems, the myApps platform services can monitor user keyboard/mouse activity and change the user's presence state after a certain amount of inactivity. The timeout can be specified using the ''advanced settings'' user interface (see [[#UI elements| UI elements]] below.

myApps will then send a [https://sdk.innovaphone.com/doc/appwebsocket/myApps.htm#SetUserActivity''SetUserActivity''] message to the PBX using the ''myApps'' protocol.

: <code>{"mt":"SetUserActivity","inactive":true}</code>

This will change the ''status'' property of the ''im:'' contact for the user's own presence and hence result in a presence update from the PBX to myApps

: <code>{"mt":"UpdateOwnPresence","presence":[{...},{"contact":"im:","activity":"","status":"closed"}]}</code>
The ''closed'' status is reflected in the grey status color when displaying a contact [[Image:myapps-inactive.png|myapps-inactive.png/|myapps-inactive.png/]].

On iOS and Android, the state is set to ''inactive'' as soon as the App is brought to background.
When myApps platform services are not available (i.e. when running the web application in a browser solely) a limited user activity monitoring is available: the state is set to active when the web page is not used for more than 5 minutes.

=== Recording ===

The new launcher offers the possibility to record the audio of incoming and outgoing calls. In order to activate that functionality the URL of the recording instance must be configured in either the PBX (PBX->myApps->Config: Recording URL) or the softphone App (Settings->Audio Recording (URL))

[[Image:PBX-Recording-Settings.png|pbx-recording-settings.png/|pbx-recording-settings.png/]] [[Image:Recording-Softphone-Settings.png|recording-softphone-settings.png/|recording-softphone-settings.png/]].

As long as that URL is configured the audio data of all calls are stored as pcap-files under that URL.
If the URL points to a CF device in the PBX, write access must be granted for that URL (PBX->Services->HTTP->Server:Public compact flash access) and if the URL points to the recording app, the files can be accessed via the recording app [[{{NAMESPACE}}:Concept_App_Service_Recordings|recording]].

Under PBX->myApps the administrator can set a certain default behaviour of the audio recording like whether or not the recording should start automatically at the beginning of the call (Recording by Default ON/OFF), only calls with external numbers should be recorded (Record external calls only) or whether or not the user should be able to start/stop the recording himself (Allow user incall recording control). Except for the last parameter these parameters can also be modified by the user in its softphone settings if the administrator doesn't set the FORCE flag.

If the user was allowed by the admin to control the recording a recording switch is active during the call when the "Media" Panel is opened. There the audio recording may be stopped and continued at will. A red recording notice is shown in the top right corner when the recording actually takes place.

[[Image:Recording-incall-switch.png|recording-incall-switch.png/|recording-incall-switch.png/]]

=== Notifications ===

The myApps platform services can use the OS specific notification mechanism (e.g. ''desktop notifications'' on Windows) to display messages (e.g. ''incoming new chat message'') to the user.

Note that the actual rendering of the notification is under control of the OS. Therefore, myApps must be allowed to show notifications and its appearance can be restricted by OS native settings.

==== Microsoft Windows Notifications ====

Microsoft Windows Server editions (2016, 2019, 2022) are just capable of showing a single ''IncomingCall'' notification at the same time (we couldn't find a workaround for this limitation). 
An ''IncomingCall'' notification is visible the whole time instead of being moved to the action center after a certain time. 
 
A notification about a missed call uses the ''IncomingCall'' type so that this notification is visible until the user returns. 
Due to the above limitation, on a new arriving call such a missed call notification is transformed to a default notification which will be moved to the action center automatically. 
 
On non server editions, you can have multiple IncomingCall notifications at the same time (so two parallel incoming calls will be indeed notified at the same time), but the missed call notification handling is the same on both platforms!

Thus there will be always just '''one''' missed call notification visible and previous missed calls can be found inside your action center!

To see myApps notifications, ensure:
* System -> Notifications
** enable notifications
** disable "Do not disturb" or allow myApps as priority application while "Do not disturb" is active
** enable notifications for myApps in the list of applications
* System -> Focus
** if a focus session is active and the "Do not disturb" is activated during a focus session, make sure that myApps is a priority application (see above)

==== macOS Notifications ====
Notifications are the same as on Windows.
The difference is, that for macOS, notifications need to be allowed in the system settings.
Go to Notifications - myApps, select Banner and enable all check marks.

=== Local phonebook access ===
'''Contact Search:''' The myApps platform services implement an ''API provider'' for the [http://sdk.innovaphone.com/web1/com.innovaphone.search/lib1_api_search.htm ''com.innovaphone.search'' API]]. They perform search capabilities on the OS' local phone books which can be used by Apps like the ''phoneapp''.

Apps would send a ''Search'' request to the API:

: <code>{"mt":"ApiRequest","consumer":"dev:SwPh_zkl_5e42e884","provider":"*","src":"4","msg":{"mt":"Search","type":"contact","search":"john doe"},"apiId":"com.innovaphone.search"}</code>
Search results are delivered as ''SearchInfo'' messages:

: <code>{"mt":"ApiResult","src":"3","provider":"@local-8125d22e37-519d-4056-bfe5-c52ef2ae8fabb0","consumer":"dev:SwPh_zkl_5e42e884","client":"@client-f62702dd86-be3f-47fc-b4bc-7a21627b75b2ea","msg":{"mt":"SearchInfo","relevance":2000,"adjust":true,"type":"contact","contact":{"givenname":"John","sn":"Doe","company":"ACME","position":"Head of everything","telephonenumber":["11111","22222"],"homephone":["+4944444","33333"],"mobile":["+49 (123) 55555"]}},"api":"com.innovaphone.search"}</code>

'''Reverse Lookup:''' The myApps platform services implement an ''API provider'' for the [http://sdk.innovaphone.com/web1/com.innovaphone.phonelookup/lib1_api_phonelookup.htm ''com.innovaphone.phonelookup'' API]. They perform search capabilities on the OS' local phone books which can be used by Apps like the ''phoneapp''.

Apps would send a ''Lookup'' request to the API:

: <code>{"mt":"ApiRequest","consumer":"dev:SwPh_zkl_5e42e884","provider":"*","src":"4","msg":{ mt: "Lookup", prefixIntl: "000", prefixNtl: "00", prefixExt:"0", area: "7031", country: "49", lookup: "0004970311234567" },"apiId":"com.innovaphone.lookup"}</code>

Search results are delivered as ''LookupInfo'' messages:

: <code>{"mt":"ApiResult","src":"3","provider":"@local-8125d22e37-519d-4056-bfe5-c52ef2ae8fabb0","consumer":"dev:SwPh_zkl_5e42e884","client":"@client-f62702dd86-be3f-47fc-b4bc-7a21627b75b2ea","msg":{mt: "LookupInfo", dn: "Jake Blues", contact: { telephonenumber: ["0004970311234567"], givenname: "Jake", sn: "Blues", company: "Blues Brothers" </code>

==== Windows ====
On Windows, the search and lookup are performed in all of the user's Outlook contact folders. As opposed to the search implemented in the ''Contacts'' and ''Users'' App, all items are returned which match any of the search words (i.e. searching for ''a b'' will return items matching either ''a'' or ''b'').

; searched properties : firstname, lastname
; returned properties : Following Outlook contact phone number properties are returned (if available):

:* OFFICE_TELEPHONE_NUMBER as ''telephonenumber''
:* OFFICE2_TELEPHONE_NUMBER as ''telephonenumber''
:* HOME_TELEPHONE_NUMBER as ''homephone''
:* HOME2_TELEPHONE_NUMBER as ''homephone''
:* MOBILE_TELEPHONE_NUMBER as ''mobile''
:* BUSINESS_FAX_NUMBER as ''facsimiletelephonenumber''
Note that contact information is cached in the search provider. Updated contacts may therefore become effective after a while only.
Outlook search will create its own trace file <code>myAppsOutlookSearch-</code>''date-time''<code>.txt</code> in the standard trace directory.

This search provider is always installed and can be disabled. There is no need (nor possibility) to enable it in the ''Apps'' tab of the PBX's user object. Also, no ''App'' object needs to be created for it.

==== Android/iOS ====
The search and lookup are performed in the contacts.

==== macOS ====
The search and lookup are performed in the contacts. If you wish to disable local contact lookup, go to system settings - Security & Privacy and disable the access to contacts for myapps.
=== Microsoft Office integration ===

The myApps platform services has a ''office presence provider'' that can provide the user's presence state to Office applications. See [[{{NAMESPACE}}:Concept_myApps_Office_Integration|myApps Office Integration]] for details.

This feature is installed by default. However, it can be disabled using the ''OFFICEPRESENCE'' MSI Parameter. Also, a check-mark is available in the setup dialog.

=== Call an external application for calls ===

Phone Apps (such as the phoneapp or softphone) can initiate the start of an external application when a new call appears (either incoming or outgoing). The actual spawning of the application is done by the myApps platform service. Also, the application properties (such as e.g. the executable's path) is configured in the myApps platform services (see [[#UI elements|Advanced settings]] in the ''UI elements'' section below).

A number of arguments can be passed to the application by substituting $-variables in the ''Parameter'' field:

; $n : phone number as dialed (called party number for outgoing calls) or received (calling party number for incoming calls)

; $N : called or calling party number in ''national'' format (e.g. 07031730090)

; $I : called or calling party number in ''international'' format (e.g. +497031730090)

: note that both $N and $I only work if $n includes both subscriber number and area code (e.g. 07031730090). Otherwise they are equal to $n

; $d : display name of peer (if known)

; $u : URI name of the peer (if available eg with a federation call)

; $c : conference id

: this is a globally unique ID for this call and may be used to relate the call to the ''guid'' found in the CallInfo structure in the [http://wiki.innovaphone.com/index.php?title=Reference10:SOAP_API#CallInfo SOAP-API] and [http://sdk.innovaphone.com/doc/appwebsocket/RCC.htm RCC-API ]. Also, corresponding [[Reference10:Call Detail Record CDR PBX|CDRs]] can be related using the ''event'' tag's ''conf'' attribute.
The start of an external application can be requested using the ''com.innovaphone.externalapps'' API.

Some setup examples are [[Howto:Integrate External Apps in innovaphone UC clients|shown here]].

=== Push ===

Mobile operating systems usually inhibit network operation of apps which run in the background or are closed by the user. This is done in order to reduce battery consumption. Unfortunately, this also stops such apps to maintain a registration by regularly sending ''keep alive'' messages to a server (in our case to the PBX). As a result, myApps will be disconnected from the PBX. When the PBX determines that there is an event for the application which needs a response, it needs to wake up the app using a dedicated channel provided by the operating system. This mechanism is know as ''push''. When running on iOS or Android, myApps supports ''push''.

For ''push'' to work, a [[{{NAMESPACE}}:PBX/Objects/Push|''push object'']] needs to be configured in the PBX . Also, it needs to be enabled on the mobile phone for the myApps app.
This mechanism is quite similar in v12 and v13, so you can refer to [[{{NAMESPACE}}:Concept_Push_Notifications_for_iOS_and_Android|the concept for push notifications for iOS and Android]] for more details.

Also, helpful hints can be found in [[Howto:Troubleshoot v13 Push with myApps for Android and iOS]].

=== App Proxy ===

myApps runs further ''Apps'' (such as e.g. the ''phoneapp'') as a web page in an IFRAME of the browser myApps is running in. The App's page code is loaded either from the PBX or from an ''application platform'' (AP). This however would mean that the App's IFRAME would remain empty (a dead white screen) when the PBX or AP is not available. To make sure the App can start-up anyway, the myApps platform services feature the so-called ''App Proxy''. This is a caching proxy that caches all the App code so it is available even in case of network failure. When myApps runs in the context of the platform services, Apps are therefore not loaded from the App source directly, but from the local App proxy.

The cached files are stored in the PCs local file system in the <code>%LOCALAPPDATA%\innovaphone\myApps\appproxy</path></code>. There is no configuration required. However, if myApps seems to run with outdated or corrupt cached copies of the App, you can safely delete the entire directory.

=== Auto update ===

On Windows and on macOS, the myApps platform services can auto-update themselves to a common version. This is controlled by the [[{{NAMESPACE}}:PBX/Config/myApps#Launcher_Software_Update | ''Launcher Software Update'']] settings under ''PBX/Config/myApps'' in the PBX.

When myApps is started or the user logs in or myApps needs to re-connect to the PBX, the platform services will use the [http://sdk.innovaphone.com/web1/com.innovaphone.client/lib1_api_client.htm com.innovaphone.client API] to learn the desired version (''launcherUpdateBuild'', which is part of the API's ''model''). If this differs from the current version, the platform services will try to download the respective new version.

{
"mt": "ApiUpdate",
"apis": {
"com.innovaphone.client": {
"@client": {
"title": "innovaphone myApps",
"model": {
"launcher": true,
"launcherUpdateBuild": "134906",
"appStoreUrl": "http://store.innovaphone.com/release/download/"
}
}
}
}
}

The installation of the downloaded version is done by the ''innovaphonemyAppsUpdateService''. This service is installed and enabled during the initial installation of the myApps platform services. To disable auto-update, either leave the ''Launcher Software Update'' settings empty or set the service's start mode to ''disabled'' in the Windows ''services control panel''.

Note that on Windows the update service does not work on terminal servers. Administrators must do myApps base services updates using standard windows mechanisms.

Note that on macOS if myApps has been installed from the Apple Store it is assumed that auto update from the PBX is not desired and disabled therefore. If you need to activate the auto update later, you will need to reinstall myApps using the .pkg file.
On Android/iOS/macOS updates can be downloaded from the respective app store.

The ''Devices'' app can not update software installed on Windows PCs directly. However, when the PBX is updated using an ''update job'' in the ''Devices'' App, the ''Launcher Software Update'' settings will be updated accordingly and hence the myApps base services will ultimately also be updated to the same version.

==== Auto update flow on Windows ====

* On start of myApps, myApps checks if an update is available and ready for installation
** if yes, the update is installed directly, without user interaction (a popup is shown during the installation)
** if not, myApps starts
* if an update is available while myApps is already running, an update notification will be shown which let's the user choose to install the update now or later (the notification will then popup again after one hour)

==UI elements ==
There are a few user interfaces provided by the platform services:
===tray-icon (Windows only) ===
::[[Image:myapps-tray.png|myapps-tray.png/|myapps-tray.png/]]
:Allows to
:* terminate myApps
:* toggle the ''autostart'' state
:* toggle the ''show in task bar'' state
:* open the trace folder
:
=== PBX connect form===
:: [[Image:myapps-connect.png|myapps-connect.png/|myapps-connect.png/]]
: Allows the user to specify the connect data for the PBX (i.e. IP address or DNS name)
:
=== Advanced settings===
[[Image:myapps-settings0.png| More button to access advanced settings]]
<gallery mode="packed" heights="420" style="float:left">
Image:MyApps-settingsNew.png|Advanced generic configuration
Image:MyApps-settingsNew2.png|Hotkeys configuration
Image:MyApps-settingsNew3.png|External launcher configuration
Image:MyApps-settingsNew4.png|Trace configuration
</gallery>
<div style="clear:both;"></div>

: Allows modification of various platform dependent settings (such as the hotkey selection on Windows, external application actions, etc).

== Interfaces ==
=== Provided APIs ===

; [http://sdk.innovaphone.com/web1/com.innovaphone.search/lib1_api_search.htm com.innovaphone.search] : access to local phone book entries by the [[#Local phonebook access|Local phonebook access]] component.
; [http://sdk.innovaphone.com/web1/com.innovaphone.launcher/com.innovaphone.launcher.htm com.innovaphone.launcher] : display of OS specific user notifications and receipt of related user actions
; com.innovaphone.notificationhandler : reports back click on a notification.
; com.innovaphone.externalapps : to start external applications, see [[#Call an external application for calls|Call an external application for calls]] above

=== Used APIs ===

; [http://sdk.innovaphone.com/web1/com.innovaphone.phone/com.innovaphone.phone.htm com.innovaphone.phone] : used to initiate new or manipulate existing calls by the [[#Hot keys|Hot keys]] and [[#URL handler|URL handler]] components.

; [http://sdk.innovaphone.com/web1/com.innovaphone.chat/com.innovaphone.chat.htm com.innovaphone.chat] : used to start a new chat by the [[#URL handler|URL handler]] component.

; [http://sdk.innovaphone.com/web1/com.innovaphone.client/lib1_api_client.htm com.innovaphone.client] : the model is used to learn the update settings, see [[#Auto update|Auto update]] above

=== Protocols ===

; [https://sdk.innovaphone.com/doc/launcher/Media.htm Media Protocol] : used by apps to allocate RTP channels, see [[#RTP service for audio.2C video and data|RTP service for audio, video and data]] above

== Related App Services ==

none

== Known limitations ==
; Incoming call as banner on myApps for iOS : Since iOS 14 the iOS CallKit presents incoming calls as a banner leaving the original green answer button of myApps visible. Use only the blue button of the banner to accept the call or change iPhone Settings, App "Phone", "Incoming Calls" to "Full Screen" to hide the myApps user interface again during call answering.

; Call answer in speakerphone mode even with active Bluetooth headset on myApps for iOS : This causes unwanted speakerphone operation if the smartphone is used with a Bluetooth car audio system. The behaviour can be changed by selecting ''Bluetooth Headset'' in this setting:
:''iOS Settings->Accessibility->Touch->Call Audio Routing: Automatic / Bluetooth Headset / Speaker''
:''iOS Einstellungen->Bedienungshilfen->Tippen->Anrufaudioausgabe: Automatisch / Bluetooth-Headset / Lautsprecher''

; Windows Server 2016 (Windows 10 Build 1607) : windows just shows the first notification. Further notifications aren't displayed until the previous ones are removed from the notification center. Current windows builds do not show this behaviour anymore.

; Problems on Mac computers with Yealink USB headsets
: we have received reports that myApps quits unexpectedly on some Mac computers when a Yealink headset is plugged in. Unfortunately, we could not find out the cause yet. If you use Yealink USB headsets and have a similar issue, please open a support ticket and send myApps traces.

; Poly / Plantronics headset buttons only functional if myApps is started with Rosetta
: myApps macOS supports Apple M1/M2 hardware natively. However, the Poly / Plantronics headset SDK is only available for Intel platform and thus myApps needs to be started via Apple's Intel emulator Rosetta if a Poly / Plantronics headset is used. This is done with right-click on the myApps executable, ''Information'', ''Open with Rosetta''.

; Windows surface devices may not work correctly
: Chromium does not get touch keyboard events. USB Keyboards may not be recognized either.

= Installation =

== Windows ==

myApps platform services are installed on Windows using the .msi file found in the ''myApps Windows'' package from [https://store.innovaphone.com/release/download.htm store.innovaphone.com].

myApps can update itself automatically, see [[#Auto update|Auto update]] above.

=== MSI Parameters and install options ===

The MSI installer of myApps for Windows supports the following parameters and can be edited with [https://docs.microsoft.com/en-us/windows/win32/msi/orca-exe Microsoft Orca]. You can add your parameters in the table ''property''.

; SERVER (REG_SZ): the PBX's server address (without protocol like https://)
; OFFICEPRESENCE (REG_DWORD): '''false''' to disable presence integration in Microsoft Office
: this is also available as a check-mark when running the install manually

; DISABLEHEADSETS (REG_DWORD): '''true''' to disable headsets support, see [[#Device handling|Device handling]] above

; EXTERNALAPPS (REG_SZ): pre-define external applications, see [[#Call an external application for calls|Call an external application for calls]] above
: e.g. <code>"{""externalApps"":[{""id"":0,""name"":""Wireshark"",""path"":""C:\\Program Files\\Wireshark\\Wireshark.exe"",""param"":""test $I""}]}"</code>

; FORCERESTART (REG_DWORD): '''true''' (or any string ...) kills myApps during the installation and restarts it for the currently logged in user, if it was running

; DISABLELOCALHOST (REG_DWORD): '''true''' to disable use of '''localhost''' string to access the local webserver. Use '''127.0.0.1''' instead

; EXCLUDEINTERFACES (REG_SZ): some VPN interfaces are not detected by Windows as IF_TYPE_PPP or IF_TYPE_TUNNEL and therefore the '''media outside VPN''' setting is not taking effect. With this option interfaces can be pre-defined that will not be used for media. Interfaces must be comma separated
: e.g. <code>EXCLUDEINTERFACES="172,192.168,10.10"</code>

; FASTERDOWNLOADS (REG_DWORD): '''true''' to have faster downloads without artificially slowing down the download of an update (which is done to avoid audio lags if clients have slow networks).

Current settings are stored in the registry at <code>Computer\HKEY_CURRENT_USER\Software\innovaphone\myApps</code> or at <code>Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\innovaphone\myApps</code>

Boolean values like OfficePresence are stored in registry entries with type REG_DWORD and values 1 or 0. 0 disables the setting and 1 enables it.

== iOS ==

myApps platform services are installed on iOS by loading ''innovaphone myApps'' from the ''App Store''.

=== Configuration via MDM ===

the PBX's server URL can be pre-configured by specifying this dictionary in the MDM
<plist>
<dict>
<key>server</key>
<string>pbx.example.com</string>
</dict>
</plist>

== macOS ==

myApps platform services might be installed directly from the Apple store. An installer package <code>myapps.pkg</code> and a disk image <code>myapps.dmg</code> is also available from the innovaphone app store. Install <code>myapps.pkg</code> by double-click on the file and follow the instructions of the installer. myApps becomes available in the Applications folder and can be opened by double-click. Or download and open <code>myapps.dmg</code> and double klick myApps. If desired integrate it into the app dock by right click, ''Options, Keep in the dock''.

If installed from the innovaphone app store, myApps can update itself automatically, see [[#Auto update|Auto update]] above.

If installed from the Apple store, macOS notifies about updates on the Apple store. myApps [[#Auto update|Auto update]] is disabled then.

If a clean-install of the client is necessary, the folder "/Users/username/Library/Containers/myapps" needs to be deleted. To be on the safe side also delete it from the trash bin.

=== Configuration via MDM ===

the PBX's server URL can be pre-configured by specifying this dictionary in the MDM
<plist>
<dict>
<key>server</key>
<string>pbx.example.com</string>
</dict>
</plist>

=== Preferences ===

macOS supports preference settings that can be set via a shell command or via Mac remote management

defaults write com.innovaphone.client-ios-14r1 server "PBX-server-URL"

The following parameters and can be set through this method:

; server: the PBX's server URL

=== Setting myApps as Default App for SIP-URLs ===

{| class="wikitable"
|defaults write com.apple.LaunchServices/com.apple.launchservices.secure LSHandlers -array-add '{
LSHandlerURLScheme = sip;
LSHandlerRoleAll = "<CFBundleIdentifier>";
}'
|}

To find the “CFBundleIdentifier”, proceed as follows:
* In the Finder under “Applications”, search for the desired myApps client that you want to set as the default app.
* Right-click on “Show package contents” -> you will find the “CFBundleIdentifier” in the Info.plist file.

A restart of the MAC is required.

=== Using Sennheiser headsets ===
If you use Sennheiser headsets, you should also install the then-current <code>DSEA_SDK_v</code>''version''<code>.pkg</code> package, after you installed the myApps client. Without that, audio will still work, but not the controls on the headset. You will need to keep that up-to-date yourself, as it is not updated by myApps's auto-update function.

== Android ==

myApps platform services are installed on Android by loading ''innovaphone myApps'' from the ''Play Store''.

=== Configuration via MDM ===

the PBX's server URL can be pre-configured by specifying a property "server" with string value "pbx.example.com" in the MDM.

== IP270 ==
For configuration instructions, refer to the [[Reference16r1:Concept IP270|IP270 concept article]].

= Configuration =

== Server configuration ==
When opening myApps for the first time, the user is prompted for the Server. Usually only the hostname (DNS host name or IP address) needs to be configured.

But there are more options for special PBX configurations.

; Non-standard HTTPS port
: If the PBX uses a non-standard HTTPS port, it must be appended to the host name separated by a colon (<code>:</code>).
: Example: <code>pbx.example.com:4444</code> (expands to <code>https://pbx.example.com:4444/PBX0/APPCLIENT/appclient.htm</code>)
; DynPBX module name
: If the PBX is a DynPBX, the module id must be appended to PBX0 separated - (<code>/</code>).
: Example: <code>pbx.example.com/PBX0-1</code> (expands to <code>https://pbx.example.com/PBX0-1/APPCLIENT/appclient.htm</code>)
; Softphone physical location
: If user defined physical location shall be used for softphone, you can append it using a parameter <code>#phys=</code>.
: Example: <code>pbx.example.com#phys=slave</code> (expands to <code>https://pbx.example.com/PBX0/APPCLIENT/appclient.htm#phys=slave</code>)

Example 1: PBX pbx.example.com with standard configuration
pbx.example.com

Example 2: PBX slave.example with DynPBX module ID 1, HTTPS port 4444 and physical location master
slave.example.com:4444/PBX0-1#phys=master

=== HTTP proxy support ===

myApps platform services do support operation via HTTP proxy now. If one or more proxies have been configured in the network settings of the operating system for the active network connection, HTTP CONNECT tunnels are established.

On Windows user name and password can be specified for the tunnel servers as generic credentials in the credentials manager (Anmeldeinformationsverwaltung). The name of the credentials must be the tunnel server hostname.

On Android user name and password can be specified through Android ''Settings, Accounts'' by adding a myApps ''HTTP Proxy Credentials'' account. The name of the account must be the tunnel server hostname.

== Platform specific settings ==
When myApps runs under the myApps platform services, it will show various platform specific settings as part of its ''burger menu'', so the user can set them. See ''Advanced settings'' in [[#UI elements|UI elements]] above.

Some options can also be set globally for all myApps clients in the PBX's [[{{NAMESPACE}}:PBX/Config/myApps#Client_Settings|PBX/Config/myApps ''Client Settings'']]
{|
! style="text-align: left; font-weight: bold" | Option

! style="text-align: left; font-weight: bold" | Description

! style="text-align: left; font-weight: bold" | Where to set

!
! style="text-align: left; font-weight: bold"| Availability
|-

| || || User menu || PBX ''Client Settings'' || Windows || iOS || Android || macOS
|IP270<ref>myApps-IP270 offers device specific settings explained in [[Reference16r1:Concept IP270|IP270 concept article]]</ref>
|-
| Autostart || Launch myApps on login || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Appear offline after || controls after which idle time a user is considered ''inactive''. See [[#User activity|User activity]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Hotkeys || Hotkeys for call dial, accept, reject. See [[#Hot keys|Hot keys]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Docking || Docking mode (left, right, none). See [[#???|??]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✗
|✗
|-

| Desktop notifications|| Turn on/off platform notifications. See [[#Notifications| Notifications]] above || ✔ ||✔ ||✔ || ✗ || ✗ || ✔
|✗
|-

| VPN || Disable VPN address for ICE candidate selection. See [[#RTP ports| RTP ports]] above || ✔ ||✔ ||✔ || ✗ || ✔ || ✔
|✗
|-

| Show in taskbar|| Show myApps in the taskbar in addition to it's tray icon. || ✔ ||✗ ||✔ || ✗ || ✗ || ✗
|✗
|-

| Log flags || turn on/off certain trace levels. See [[#Troubleshooting|Troubleshooting]] below. || ✔ ||✔ ||✔ || ✔ || ✔ || ✔
|✔

|-

| External applications || define the applications available for Apps to be started. See [[#Call an external application for calls|Call an external application for calls]] above. || ✔ ||✗ ||✔ || ✗ || ✗ || ✔
|✗
|-

| Ring in headset || send ring tone for incoming to headset instead of loudspeaker. || ✔ ||✗ ||✔ || ✗ || ✗ || ✗
|✗
|}
<references/>

== Start parameters for Windows ==

On Windows, it is not possible to pass start parameters from the [https://www.chromium.org/developers Chromium documentation] to the myApps process.

== OS Settings for Windows ==
Windows settings can influence the display of ''Desktop notifications''. See [https://support.microsoft.com/en-us/help/4028678/windows-10-change-notification-settings Change notification settings in Windows 10/11] for details.

=== Windows 11 ===

* Windows 11 has a feature "do not disturb". This hides notifications if enabled.
* Windows 11 has a feature "focus". This enables "do not disturb" and thus hides notifications too.
* Windows 11 has priority settings for notifications. Ensure that VoIP notifications for calls are allowed any maybe also include myApps as an App which is allowed to show notifications.

== OS settings for Android ==
; Events : The appearance of notifications can be controlled here.

; Call accounts : For proper incoming call signaling, the call account ''myApps'' needs to be enabled. Note that on Samsung smartphones the call account switch likely toggles back and a few tries may need to be done until it persists. Please double-check the state.

; Preferred Calling Account : Choose which calling account (myApps/SIM/..) should be used for outgoing calls initiated from within the native phone app / phone book.

; Background data, unlimited data usage : Grant background data use to enable ''myApps'' to connect to the PBX immediately on an incoming call.

; Overlaying : This setting is not needed if call account ''myApps'' has been enabled. Should there be a reason for not enabling call account ''myApps'', the permission for overlaying needs to be granted on Android 10 or higher for proper call signaling. On Android 17 overlaying (navigate to ''Settings, select Apps, tap Special app access'' (or the menu icon), choose ''Display over other apps'') might show ''deactivated''. Navicate and click ''Android Settings -> Apps -> myApps -> 3 dots menu -> Enable restricted settings'' to release this deactivation and then grant the permission.

Note: If no SIM card is installed some Android smartphones exhibit a problem dialing from the smartphone contacts. The contacts app shows a choice ''Select SIM card for this call'' but all possible dialers are greyed out. In this case make myApps the default phone app in Android settings ''Apps, Default apps, Telephony''.

== OS settings for iOS ==
; Notifications : The appearance of notifications can be controlled in iOS ''Settings, myApps''.

== OS settings for macOS ==

; Notifications : The appearance of notifications can be controlled in macOS ''Preferences, Notifications, myApps''.

=Troubleshooting=

myApps platform services can write various traces for debugging. Trace can be turned on and off selectively in the [[#Advanced settings|Advanced settings]].

The following trace flags can be set:

(''Recommended trace options are: '''App, Browser, ICE, TURN, Signaling and Audio'''. Please do not activate other flags unless innovaphone support says otherwise'')

{|
!style="text-align: left; font-weight: bold" | Abbreviation

!style="text-align: left; font-weight: bold" |code

!style="text-align: left; font-weight: bold" | description

|-
| App||0x000000001|| logs from the App Service itself
|-
| DNS||0x000000008|| logs DNS requests and results
|-
| HTTP client||0x000000080|| http client logs
|-
| TLS||0x000000400|| TLS logs
|-
| TCP||0x000000800|| TCP logs
|-
| LDS||0x000001000|| local domain sockets
|-
| WebSocket client||0x000004000|| logs outgoing websocket connections
|-
| App WebSocket||0x000008000|| logs app websocket connections (e.g. from PBX objects to an App Service or from the UI to the App Service)
|-
| UDP||0x000200000|| UDP logs
|-
| DTLS||0x000400000|| logs DTLS handshake and messages
|-
| Media||0x000800000|| logs media events
|-
| Media channel||0x001000000|| logs RTP/SCTP media connections
|-
| ICE||0x002000000|| logs ICE messages between peers
|-
| TURN||0x004000000|| logs TURN messages between peers
|-
| AppSharing||0x008000000|| logs AppSharing connection
|-
| Audio||0x010000000|| logs Audio connection and headset events
|-
| Video||0x020000000|| logs video connection and webcam events
|-
| Browser||0x040000000|| logs Chromium events
|-
| AppProxy||0x080000000|| logs requests which are proxied between the local webserver and the remote server
|-
| Webserver ||0x200000000|| enables webserver specific logs
|-
| Browser Console ||0x400000000|| logs browser console events
|-
| Signaling||0x800000000|| enables logs in the signaling module for debugging calls
|}
''code'' can be or'ed and used as value for the ''Log flags'' field in [[{{NAMESPACE}}:PBX/Config/myApps#Client_Settings|PBX/Config/myApps/Client Settings]].

== Windows ==
On Windows, traces are written to the <code>%LOCALAPPDATA%\innovaphone\myApps</code> directory. If you start myApps with --log-size as parameter, you can define the maximum size of a log file (e.g. --log-size=100000000 would be 100MB for each file)

:* myApps-''date-time''.txt : main log file for the platform services

:* myAppsOutlookSearch-''date-time''.txt : log file for the Outlook phone book access

:* myAppsHookController-''date-time''.txt : log file for the hot-key interceptor (see [[#Hot keys|Hot keys]])

; :myApps update installation traces are written to the <code>%windir%\temp\</code> directory.
:* myAppsInstall.txt: MSI installation file

; :myApps update service traces are written to the <code>%ProgramData%\innovaphone\myAppsUpdateService</code> directory.
:* myAppsUpdateService-''date-time''.txt: myApps update service traces

==Android==
traces can be sent by e-mail.

Also, an Android device might also be connected to a PC via an USB cable to get the traces. The files can be found in <code>Android/data/com.innovaphone.clientandroid/files</code>

== iOS ==
traces can be sent by e-mail.

== macOS ==
traces can be sent by e-mail.

Also, files can be found in <code>~/Library/Containers/com.innovaphone.client-ios/Data/Documents/</code>. Press ''Alt+N'' followed by space to get tilde ''~''.

== IP270 ==
Refer to the [[Reference16r1:Concept IP270#Troubleshooting|IP270 concept article section troubleshooting]].

= Known Problems =
[[:Category:Problem myApps platform services|Known Problems]]

= Related Articles =
* [[{{NAMESPACE}}:Concept_myApps]]
* [[{{NAMESPACE}}:Concept_myApps_Redundancy|Concept myApps Redundancy]]
* [[{{NAMESPACE}}:Concept_myApps_Office_Integration|Concept myApps Office Integration]]
* [[{{NAMESPACE}}:Concept_myAPPs_Search_in_local-Outlook_Contacts|Concept myAPPs Search in local Outlook Contacts]]
* [[{{NAMESPACE}}:Call_Detail_Record_CDR_PBX|Call Detail Records]]
* [[{{NAMESPACE}}:Concept Push Notifications for myPBX iOS and Android|Concept Push Notifications for myPBX iOS and Android]]
* [[Howto:Troubleshoot v13 Push with myApps for Android and iOS]]
* [[{{NAMESPACE}}:PBX/Config/myApps|Reference16r1:PBX/Config/myApps]]
* [[{{NAMESPACE}}:Concept_IP270|IP270 concept article]]
[[Category:Concept myApps platform services]]

Howto16r1:Configure OAuth2 E-Mail

2025-10-08T21:55:39Z

Tmo: /* Modes */

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

The innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== General Information ==
Most of the large email providers offer the possibility to define an app that is allowed to gain access of a certain scope like SMTP. 
It assigns a Client ID / Client Secret. 
 
Authorization for sending from the mail account needs to be given one time either: 
* By providing resource owner username/password. Sending this to the token endpoint results in an access token and long term refresh token.
* By interactive authorization via a popup dialogue that is loaded from the authorization endpoint. After the credentials are verified, the dialogue redirects to the redirect URI with an authorization code that is traded to an access token and refresh token.
 
The access token is sent for authentication in SMTP. It needs regular refresh, which will be done automatically.

=== Modes ===

* '''Exchange''': Microsoft, with interactive authorization
* '''Microsoft 365''': Microsoft, without interactive authorization (Resource owner and password has to be filled)
* '''Gmail''': Google, with interactive authorization
* '''Google Service Account''': Google, without interactive authorization (Client e-mail, Private Key ID and Private Key of the service account must be provided)
* '''Client secret post''': Generic configuration where all parameters of the client secret post OAuth2 flow can be set.
* '''Private key jwt''': Generic configuration where all parameters of the private key jwt OAuth2 flow can be set.

== Microsoft 365 ==
=== Azure Portal ===
Log in to Microsoft Azure Portal (https://portal.azure.com) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret. Note that expiry is limited to no longer than 2 years. The client secret must be renewed before expiry and the new secret configured and interactive authorisation carried out again to ensure continuous operation.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]

=== Microsoft 365 admin center ===
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]

=== Exchange admin center ===
Login to the Exchange admin center (https://admin.exchange.microsoft.com).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]

=== PBX Example configuration ===
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
=== Preparations ===
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]

=== PBX Example configuration ===
The OAuth2 parameters can be filled in with the information from the json file downloaded above. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

For other e-mail providers the client secret post OAuth2 flow may be configured in a generic way. Details need to be supplied by the e-mail provider.

For the Microsoft 365 setup above it would be as follows with Token endpoint ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/token</nowiki>'' Authorization URL ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/authorize?scope=https://outlook.office.com/SMTP.Send</nowiki> offline_access'' The configuration appends ''&response_type=code&prompt=consent&login_hint=...&redirect_uri=...&client_id=...'' automatically.[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png|/OAuth2ClientSecretPost.png]]
For the Gmail example above the generic confguration would be like this with Token endpoint ''<nowiki>https://oauth2.googleapis.com/token</nowiki>'' Authorization URL ''<nowiki>https://accounts.google.com/o/oauth2/auth?access_type=offline&scope=https://mail.google.com/</nowiki>'' The configuration appends ''&response_type=code&prompt=consent&login_hint=...&redirect_uri=...&client_id=...'' automatically.
[[File:OAith2ClientSecretPostGmail.png|none|thumb|600x600px|/OAith2ClientSecretPostGmail.png|/OAith2ClientSecretPostGmail.png]]
The private key jwt OAuth2 flow can be configured generically as well.[[File:OAuth2PrivateKeyJWT.png|none|thumb|600x600px|/OAuth2PrivateKeyJWT.png|/OAuth2PrivateKeyJWT.png]]

== Related Articles ==
https://wiki.innovaphone.com/index.php?title=Reference16r1:PBX/Config/Authentication

Howto16r1:Configure OAuth2 E-Mail

2025-10-08T21:26:50Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

The innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Principle ==
The e-mail provider enables definition of an app that is allowed to gain access of a certain scope like SMTP. It assigns a Client ID / Client Secret.

Authorization for sending from the mail account needs to be given one time:
by providing resource owner username/password. Sending this to the token endpoint results in an access token and long term refresh token.
or interactively via the dialog that is loaded from the authorization endpoint. On agreement the dialog redirects to the redirect URI with an authorization code that is traded to an access token and refresh token.

The access token is sent for authentication in SMTP. It needs regular refresh.

== Microsoft 365 ==
=== Azure Portal ===
Log in to Microsoft Azure Portal (https://portal.azure.com) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret. Note that expiry is limited to no longer than 2 years. The client secret must be renewed before expiry and the new secret configured and interactive authorisation carried out again to ensure continuous operation.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]

=== Microsoft 365 admin center ===
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]

=== Exchange admin center ===
Login to the Exchange admin center (https://admin.exchange.microsoft.com).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]

=== PBX Example configuration ===
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
=== Preparations ===
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]

=== PBX Example configuration ===
The OAuth2 parameters can be filled in with the information from the json file downloaded above. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

For other e-mail providers the client secret post OAuth2 flow may be configured in a generic way. Details need to be supplied by the e-mail provider.

For the Microsoft 365 setup above it would be as follows with Token endpoint ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/token</nowiki>'' Authorization URL ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/authorize?scope=https://outlook.office.com/SMTP.Send</nowiki> offline_access'' The configuration appends ''&response_type=code&prompt=consent&login_hint=...&redirect_uri=...&client_id=...'' automatically.[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png|/OAuth2ClientSecretPost.png]]
For the Gmail example above the generic confguration would be like this with Token endpoint ''<nowiki>https://oauth2.googleapis.com/token</nowiki>'' Authorization URL ''<nowiki>https://accounts.google.com/o/oauth2/auth?access_type=offline&scope=https://mail.google.com/</nowiki>'' The configuration appends ''&response_type=code&prompt=consent&login_hint=...&redirect_uri=...&client_id=...'' automatically.
[[File:OAith2ClientSecretPostGmail.png|none|thumb|600x600px|/OAith2ClientSecretPostGmail.png]]
The private key jwt OAuth2 flow can be configured generically as well.[[File:OAuth2PrivateKeyJWT.png|none|thumb|600x600px|/OAuth2PrivateKeyJWT.png|/OAuth2PrivateKeyJWT.png]]

== Related Articles ==
https://wiki.innovaphone.com/index.php?title=Reference16r1:PBX/Config/Authentication

Reference16r1:Apps/PbxManager/Email

2025-10-06T11:38:15Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}
This PBX Manager Plugin configures the E-Mail Account of all PBXes in the system. The same configuration can be found in the advanced UI of the individual PBXes at [[Reference13r2:PBX/Config/Authentication|PBX/Config/Authentication]].

== Add Email Account ==
; SMTP Server
: Your SMTP Server

; Email Address
: The used From Address

; Username
: The username for the authorization

; Password
: The password for the authorization

; Sender's name
: The used Name in the From field

; OAuth2
: Alternatively OAuth2 credentials to authenticate for e-mail sending. See [[Howto16r1:Configure_OAuth2_E-Mail]].

Reference13r1:Services/Logging

2025-10-06T11:35:54Z

Tmo:

== Log Server ==
External '''logging''' is disabled by default (Off). You can still view log messages in real time (see [[Reference7:Administration/Diagnostics/Logging|Logging]]), but messages are not stored or sent to an external destination.

Available ''Type''s:

{|
|valign=top nowrap=true|'''Off:'''
| Logging is disabled.
|-
|valign=top nowrap=true|'''TCP:'''
| The device transmits the syslog entries using a TCP connection.
* In the '''Address''' field, the remote IP-address is entered.
* In the '''Port''' field, the remote port is specified.
|-
|valign=top nowrap=true|'''SYSLOG:'''
| The syslog entries are transmitted to a syslog recipient (also referred to as syslogd, syslog server or syslog daemon).
* In the '''Address''' field, the IP-address of the syslogd server is entered.
* In the '''Class''' field, the syslog message class for the syslog entries sent is entered. The class is a numeric value between 0 and 7, it will be used as ''Facility'' (0 => local0, ... 7 => local7). The ''Severity'' field will always be 6 (informational). See [http://de.wikipedia.org/wiki/Syslog wikipedia.org/wiki/Syslog] for details.
|-
|valign=top nowrap=true|'''HTTP:'''
| The syslog entries are transferred to a web server. Each individual syslog entry is transferred to the server as an individual request.
* In the '''Address''' field, the IP-address of remote server is entered.
* In the '''Path''' field, the relative URL to be used in the HTTP request is entered.
* The Method field selects the method used to send the request. There are 3 formats available:
{|
| Format || Request Type || URI || Description
|-
| Standard || POST || ''hardwired'' || This should be used to forward log messages to another innovaphone device, e.g. to store it on a central CF card
|-
| External(POST) || POST || as defined in the Path field || This is identical to the ''Standard'' method, except that you may specifiy the URI to be used
|-
| External(GET) || GET || as defined in the Path field || The log message will be coded into GET ''form data'' (a.k.a. ''query args''). This method is compatible to the method used in firmware versions 5.01 and 6.
|}
For more information on HTTP request formatting, see [[Reference7:HTTP Request Message Format]].

If the addressed Web server requires authentication, an ''Authenticated URL'' has to be configured on the [[Reference:Configuration/General/HTTP-Client|HTTP-Client]] Page. The ''URL'' constructed by the logger is shown right next to the ''Path'' field. It must be entered in exactly this format on the [[Reference:Configuration/General/HTTP-Client|HTTP-Client]] Page. The device has to be restarted after the ''Authenticated URL'' has been set.
|-
|valign=top nowrap=true|'''LOCAL:'''
| The syslog entries are saved to [[Reference:Administration/Diagnostics/CF|the local CF card]] into the '''/log''' directory, e.g. '''\\''ipaddr''\drive\CF0\log'''. Log files named '''LOG0.''n''''' are created, where '''''n''''' goes from 0 to 3. The next log file is created when either the '''Max File Size''' is reached or the '''Backup Time''' has passed. '''LOG0.0''' is the newest log file always.

To concentrate all syslog messages to a single CF card, you would use the '''HTTP Log Server Type''' in all but one boxes with '''Method''' set to '''Standard'''. '''Address''' must be set to the IP-address of the single box that has the CF card used for log message storage. '''Port''' must be set to the port configured for the [[Reference:Configuration/General/HTTP-Server|HTTP-Server]] of this box.

|-
|valign=top nowrap=true|'''LOCAL-AP:'''
|The logs are transmitted to the local Linux application platform. Logs are stored under \\AP-IP\webdav\log\ and alarms under \\AP-IP\webdav\alarm\
|-
|valign=top nowrap=true|'''REMOTE-AP:'''
|The logs are transmitted to a remote Linux application platform. Store path is the same as under LOCAL-AP.
* In the Address field, you enter the IP address of the remote Linux application platform.
* In the Port field, you specify the port to which the connection is set up.
Remark: Don't forget to enable access to \\AP-IP\ap\log.fcgi as [[Reference10:Concept_Linux_Application_Platform#Use_as_Log_or_Alarm_Server | required for use of LinAP as logserver]].
|-
|valign=top nowrap=true|'''REMOTE-AP-S:'''
|Same as REMOTE-AP, just a secure transmission is used.
|}

A second server may be configured as '''Log Server Shadow''' receiving the same records as the first server.

== Alarm and Event Handling ==
Alarm and event forwarding is configured independently from the handling of log messages.

If no '''Forward Server''' is configured in the '''Alarm and Event Forward Server''' area, alarms and events are stored locally as specified in the '''Local Alarm and Event Queues''' area below. Otherwise, alarms and events are additionally forwarded to the external server using HTTP requests. Each individual alarm or event entry is transferred to the server as an individual request. 
<code>SYSLOG</code> option is only available on Gateway devices. Phones should use HTTP to forward alarm/events to an innovaphone gateway which may forward the collected events to a syslog server.

* The '''Address''' is used to set the IP-address of an external HTTP server that will receive the forwarded alarms and events.
* The '''Port''' defines the TCP port the HTTP request is sent to.
* The '''Method''' selects the method used to send the the requests. The same methods as for the '''Log Server''' are available here. (only on gateways)

To collect all alarms and events in a single device card, you would use the '''Standard Method''' in all but one boxes. '''Address''' must be set to the IP-address of the central box. '''Port''' must be set to the port configured for the [[{{NAMESPACE}}:Configuration/General/HTTP-Server|HTTP-Server]] of this box. 
The collected alarms and events may further be forwarded to one or two SYSLOG server(s) as XML-encoded records.
This is achieved by configuring a '''Forward Server''' with '''Method''' SYSLOG, the server address under '''Address''' and the SYSLOG-Class under '''Class'''.

The '''Local Alarm and Event Queues''' area allows you to control the number of events and alarms that are kept in memory and stored in non-volatile memory during restarts.

== Alarms and Errors as Email ==
Definition of email target to send alarms and errors as email to.

* '''Sender Address''': email adress of sender
* '''Senders' Name''': alias of sender name
* '''Recipient Address''': email adress of recipient
* '''Recipients' Name''': alias of recipient name
* '''Email Server Address''': ip-adress or DNS name of smtp email server. TLS will be supported automatically, if demanded by the server.
* '''User''': user account at email server
* '''Password''': user password at email server
* '''OAuth2''': Alternatively OAuth2 credentials to authenticate for e-mail sending. See [[Howto16r1:Configure_OAuth2_E-Mail]].

== Handling of incoming Alarms/Events ==
{|
|valign=top nowrap=true|'''Authenticate:'''
| When enabled request HTTP Authentication for the incoming HTTP Alarms/Events messages. You must configure in the sender the HTTP credentials to be able to deliver the Alarms/Events.
|-
{|
== Local Alarm and Event Queues ==
{|
|valign=top nowrap=true|'''Memory Queue Entries:'''
| Maximum number of faults and alarms to hold in volatile memory (DRAM)(Default:100).
|-
|valign=top nowrap=true|'''Persistent Queue Entries:'''
| Maximum number of faults and alarms to keep in flash memory (Default:50).
|-
{|

== Catch trace on Event ==

Event codes (up to 4 different) may be configured, on which the tracing is stopped. The event codes can be copied from actual events displayed on Maintenance/Events. Hexadecimal values was converted and stored as Decimal values.

After the event has happend the trace was stopped, the trace can be read which hopefully contains what caused the event.

You can restart the logfile by emptying the [[{{NAMESPACE}}:Maintenance/Diagnostics/Tracing |buffer]].

Howto16r1:Configure OAuth2 E-Mail

2025-10-06T11:28:27Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret. Note that expiry is limited to no longer than 2 years. The client secret must be renewed before expiry and the new secret configured and interactive authorisation carried out again to ensure continuous operation.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

For other e-mail providers the client secret post OAuth2 flow may be configured in a generic way. Details need to be supplied by the e-mail provider.

For the Microsoft 365 setup above it would be as follows with Token endpoint ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/token</nowiki>'' Authorization URL ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/authorize?scope=https://outlook.office.com/SMTP.Send</nowiki> offline_access'' The configuration appends ''&response_type=code&prompt=consent&login_hint=...&redirect_uri=...&client_id=...'' automatically.[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png|/OAuth2ClientSecretPost.png]]
For the Gmail example above the generic confguration would be like this with Token endpoint ''<nowiki>https://oauth2.googleapis.com/token</nowiki>'' Authorization URL ''<nowiki>https://accounts.google.com/o/oauth2/auth?access_type=offline&scope=https://mail.google.com/</nowiki>'' The configuration appends ''&response_type=code&prompt=consent&login_hint=...&redirect_uri=...&client_id=...'' automatically.
[[File:OAith2ClientSecretPostGmail.png|none|thumb|600x600px|/OAith2ClientSecretPostGmail.png]]
The private key jwt OAuth2 flow can be configured generically as well.[[File:OAuth2PrivateKeyJWT.png|none|thumb|600x600px|/OAuth2PrivateKeyJWT.png|/OAuth2PrivateKeyJWT.png]]

Howto16r1:Configure OAuth2 E-Mail

2025-10-05T08:08:43Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

For other e-mail providers the client secret post OAuth2 flow may be configured in a generic way. Details need to be supplied by the e-mail provider.

For the Microsoft 365 setup above it would be as follows with Token endpoint ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/token</nowiki>'' Authorization URL ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/authorize?scope=https://outlook.office.com/SMTP.Send</nowiki> offline_access'' The configuration appends ''&response_type=code&prompt=consent&login_hint=...&redirect_uri=...&client_id=...'' automatically.[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png|/OAuth2ClientSecretPost.png]]
For the Gmail example above the generic confguration would be like this with Token endpoint ''<nowiki>https://oauth2.googleapis.com/token</nowiki>'' Authorization URL ''<nowiki>https://accounts.google.com/o/oauth2/auth?access_type=offline&scope=https://mail.google.com/</nowiki>'' The configuration appends ''&response_type=code&prompt=consent&login_hint=...&redirect_uri=...&client_id=...'' automatically.
[[File:OAith2ClientSecretPostGmail.png|none|thumb|600x600px]]
The private key jwt OAuth2 flow can be configured generically as well.[[File:OAuth2PrivateKeyJWT.png|none|thumb|600x600px|/OAuth2PrivateKeyJWT.png|/OAuth2PrivateKeyJWT.png]]

File:OAith2ClientSecretPostGmail.png

2025-10-05T07:50:49Z

Tmo:

OAuth2 Client Secret Post Gmail

Howto16r1:Configure OAuth2 E-Mail

2025-10-05T06:49:39Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

For other e-mail providers the client secret post OAuth2 flow may be configured in a generic way. Details need to be supplied by the e-mail provider.

For the Microsoft 365 setup above it would be as follows with

Token endpoint: ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/token</nowiki>''

Authorization URL: ''<nowiki>https://login.microsoftonline.com/af326a34-169c-469e-946b-1ef57925306b/oauth2/v2.0/authorize?scope=https://outlook.office.com/SMTP.Send</nowiki> offline_access''
[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png|/OAuth2ClientSecretPost.png]]
For the Gmail example above the generic confguration would be like this with

The private key jwt OAuth2 flow can be configured generically as well.
[[File:OAuth2PrivateKeyJWT.png|none|thumb|600x600px|/OAuth2PrivateKeyJWT.png|/OAuth2PrivateKeyJWT.png]]

Howto16r1:Configure OAuth2 E-Mail

2025-10-03T11:54:39Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

For other e-mail providers the client secret post OAuth2 flow may be configured in a generic way. Details need to be supplied by the e-mail provider.
[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png|/OAuth2ClientSecretPost.png]]
The private key jwt OAuth2 flow can be configured generically as well.
[[File:OAuth2PrivateKeyJWT.png|none|thumb|600x600px|/OAuth2PrivateKeyJWT.png|/OAuth2PrivateKeyJWT.png]]

Howto16r1:Configure OAuth2 E-Mail

2025-10-03T08:16:53Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

For other e-mail providers the client secret post OAuth2 flow may be configured in a generic way. Details need to be supplied by the e-mail provider.
[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png|/OAuth2ClientSecretPost.png]]
The private key jwt OAuth2 flow can be configured generically as well.
[[File:OAuth2PrivateKeyJWT.png|none|thumb|600x600px|/OAuth2PrivateKeyJWT.png]]

Howto16r1:Configure OAuth2 E-Mail

2025-10-03T08:16:26Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

For other e-mail providers the client secret post OAuth2 flow may be configured in a generic way. Details need to be supplied by the e-mail provider.
[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png|/OAuth2ClientSecretPost.png]]
The private key jwt OAuth2 flow can be configured generically as well.
[[File:OAuth2PrivateKeyJWT.png|none|thumb|600x600px]]

File:OAuth2PrivateKeyJWT.png

2025-10-03T08:15:18Z

Tmo: Tmo uploaded a new version of File:OAuth2PrivateKeyJWT.png

OAuth2 Private Key JWT

Howto16r1:Configure OAuth2 E-Mail

2025-10-03T08:14:05Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

For other e-mail providers the client secret post OAuth2 flow may be configured in a generic way. Details need to be supplied by the e-mail provider.
[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png|/OAuth2ClientSecretPost.png]]
The private key jwt OAuth2 flow can be configured generically as well.

3

File:OAuth2PrivateKeyJWT.png

2025-10-03T08:11:27Z

Tmo:

OAuth2 Private Key JWT

Howto16r1:Configure OAuth2 E-Mail

2025-10-03T07:58:49Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

1
[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px|/OAuth2ClientSecretPost.png]]
2

3

Howto16r1:Configure OAuth2 E-Mail

2025-10-03T07:58:10Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}
[[File:OAuth2ClientSecretPost.png|none|thumb|600x600px]]
innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

1

2

3

File:OAuth2ClientSecretPost.png

2025-10-03T07:57:49Z

Tmo:

OAuth2 Client Secret Post

Howto16r1:Configure OAuth2 E-Mail

2025-10-03T07:51:29Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]

== Generic ==

1

2

3

Howto16r1:Configure OAuth2 E-Mail

2025-10-03T07:50:22Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
Download the credentials. This json file contains all information for OAuth2 configuration.
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
Customize the OAuth consent screen
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
Start the customization wizard.
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
Choose which users may authorize.
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
Google workspace users may choose internal audience. Users not in Google workspace proceed with external.
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
Add a test user.
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
The OAuth2 parameters can be filled in with the information from the json file downloaded above.
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]
8

File:OAuth2InteractiveGmail.png

2025-10-03T07:37:23Z

Tmo: Tmo uploaded a new version of File:OAuth2InteractiveGmail.png

OAuth2 interactive Gmail

Howto16r1:Configure OAuth2 E-Mail

2025-10-03T07:33:52Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px|/GoogleApisServicesFromLibrary.png]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
User data access is needed.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
Configure the consent screen of the interactive authorization.
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
Specify the permissions that need to be authorized by the user.
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
Its mail.google.com in general.
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
And its to send email on the users behalf.
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
These are the scopes needed.
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
Ask client credentials for Web type application.
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
9
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
1
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
2
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
3
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
4
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
5
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
6
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
7
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]
8

Howto16r1:Configure OAuth2 E-Mail

2025-10-03T06:05:55Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}

innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
Login to the Google Cloud Console (https://console.cloud.google.com), select a project, New project.
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png|/GoogleSelectProject.png]]
Create the project.
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png|/GoogleCreateProject.png]]
Client credentials will be created in this project.
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png|/GoogleProjectCreated.png]]
From the library specify the APIs needed to access.
[[File:GoogleApisServicesFromLibrary.png|none|thumb|600x600px]]
These are in the Gmail API.
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png|/GoogleApisServicesApiLibrary.png]]
Choose the Gmail API and enable it.
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png|/GoogleGmailApis.png]]
Credentials need to be created.
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png|/GoogleGmailApiAdded.png]]
Invoke the help me choose wizard.
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png|/GoogleCreateCredentialsHelpMeChoose.png]]
Access is needed with interactive authorization and user data access.
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png|/GoogleCredentialsUserData.png]]
3
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png|/GoogleOAuthConsentScreen.png]]
4
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png|/GoogleOAuthScopes.png]]
5
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png|/GoogleScopeMailGoogleCom.png]]
6
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png|/GoogleScopeAuthGmailSend.png]]
7
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png|/GoogleScopes.png]]
8
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png|/GoogleOAuthClientID.png]]
9
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png|/GoogleRedirectURIs.png]]
1
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png|/GoogleClientCredentialsDownload.png]]
2
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png|/GoogleOAuthConsentScreenSettings.png]]
3
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png|/GoogleConsentScreenWizard.png]]
4
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png|/GoogleAudienceExternal.png]]
5
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png|/GoogleContactInformation.png]]
6
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png|/GoogleTestUserAdded.png]]
7
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px|/OAuth2InteractiveGmail.png|/OAuth2InteractiveGmail.png]]
8

File:GoogleApisServicesFromLibrary.png

2025-10-03T06:01:09Z

Tmo:

APIs services from library

Howto16r1:Configure OAuth2 E-Mail

2025-10-02T21:08:38Z

Tmo:

Howto16r1:Configure OAuth2 E-Mail

2025-10-02T21:07:47Z

Tmo:

{{FIXME|reason=This product is in the beta phase and is not yet finished}}
[[File:OAuth2InteractiveGmail.png|none|thumb|600x600px]]
innovaphone PBX and apps can be configured to send E-Mails for various subjects and purposes. Major E-Mail providers intent to discontinue the username/password authentication schemes in favour of OAuth2. PBX and Apps version 16r1 does support OAuth2 authentication for SMTP. Here is a step by step guide how to set up OAuth2 support in Microsoft 365 through the Azure Portal and how to set it up on a Google Gmail account in the Google Cloud Console.

== Microsoft 365 ==
Log in to Microsoft Azure Portal (<nowiki>https://portal.azure.com</nowiki>) and go to Microsoft Entra ID.
[[File:AzureMicrosoftEntraID.png|none|thumb|600x600px|/AzureMicrosoftEntraID.png|/AzureMicrosoftEntraID.png]]
Add a new app registration to create client credentials.
[[File:AzureAddAppRegistration.png|none|thumb|600x600px|/AzureAddAppRegistration.png|/AzureAddAppRegistration.png]]
Register the application and maybe already fill in the redirect URI for Web based application type to path OAUTH2-CLIENT/auth.htm at the PBX.
[[File:AzureRegisterAnApplication.png|none|thumb|600x600px|/AzureRegisterAnApplication.png|/AzureRegisterAnApplication.png]]
App registration is complete. Client ID and tenant needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureApp.png|none|thumb|600x600px|/AzureApp.png|/AzureApp.png]]
Create a client secret.
[[File:AzureAddClientSecret.png|none|thumb|600x600px|/AzureAddClientSecret.png|/AzureAddClientSecret.png]]
Copy the client secret. It also needs to be configured at the PBX and every app that will be sending e-mails.
[[File:AzureCopyClientSecret.png|none|thumb|600x600px|/AzureCopyClientSecret.png|/AzureCopyClientSecret.png]]
Add permissions located in APIs my organization uses.
[[File:AzureAddApiPermissionMyOrganization.png|none|thumb|600x600px|/AzureAddApiPermissionMyOrganization.png|/AzureAddApiPermissionMyOrganization.png]]
More precisely located in Office 365 Exchange Online.
[[File:AzureAddApiPermissionExchange.png|none|thumb|600x600px|/AzureAddApiPermissionExchange.png|/AzureAddApiPermissionExchange.png]]
And there in the application permissions.
[[File:AzureAddApiExchangeApplication.png|none|thumb|600x600px|/AzureAddApiExchangeApplication.png|/AzureAddApiExchangeApplication.png]]
Namely SMTP Mail.Send.
[[File:AzureAddApiSendMailAsUser.png|none|thumb|600x600px|/AzureAddApiSendMailAsUser.png|/AzureAddApiSendMailAsUser.png]]
Grant admin permission for Mail.Send.
[[File:AzureGrantApiPermissions.png|none|thumb|600x600px|/AzureGrantApiPermissions.png|/AzureGrantApiPermissions.png]]
API permissions are now granted.
[[File:AzureApiPermissionsGranted.png|none|thumb|600x600px|/AzureApiPermissionsGranted.png|/AzureApiPermissionsGranted.png]]
Tell all redirect URIs that the PBX and the apps will be using during interactive authorization.
[[File:AzureRedirectUris.png|none|thumb|600x600px|/AzureRedirectUris.png|/AzureRedirectUris.png]]
Allow public client flows of OAuth2. Resource Owner Password Credentials Flow has the advantage that it doesn't need interactive authorization.
[[File:AzureAllowPublicClientFlows.png|none|thumb|600x600px|/AzureAllowPublicClientFlows.png|/AzureAllowPublicClientFlows.png]]
Log in to the Microsoft 365 admin center (https://admin.cloud.microsoft).
[[File:MS365AdminCenter.png|none|thumb|600x600px|/MS365AdminCenter.png|/MS365AdminCenter.png]]
Make sure that Microsoft 365 licenses are assigned to your user.
[[File:MS365UserLicenses.png|none|thumb|600x600px|/MS365UserLicenses.png|/MS365UserLicenses.png]]
Set your user active.
[[File:MS365ActiveUsers.png|none|thumb|600x600px|/MS365ActiveUsers.png|/MS365ActiveUsers.png]]
Locate the Mail tab of your user.
[[File:MS365UserEMail.png|none|thumb|600x600px|/MS365UserEMail.png|/MS365UserEMail.png]]
Allow authenticated SMTP.
[[File:MS365AuthenticatedSMTP.png|none|thumb|600x600px|/MS365AuthenticatedSMTP.png|/MS365AuthenticatedSMTP.png]]
Login to the Exchange admin center (<nowiki>https://admin.exchange.microsoft.com</nowiki>).
[[File:ExchangeAdminCenter.png|none|thumb|600x600px|/ExchangeAdminCenter.png|/ExchangeAdminCenter.png]]
Remove deactivation of the SMTP AUTH protocol.
[[File:ExchangeRemoveDeavtivatedOAuth2.png|none|thumb|600x600px|/ExchangeRemoveDeavtivatedOAuth2.png|/ExchangeRemoveDeavtivatedOAuth2.png]]
With this Microsoft setup the OAuth2 configuration for the resource owner password credentials flow can be filled in as follows.
[[File:OAuth2ResourceOwnerPasswordCredentials.png|none|thumb|600x600px|/OAuth2ResourceOwnerPasswordCredentials.png|/OAuth2ResourceOwnerPasswordCredentials.png]]
For interactive authorization this is the OAuth2 configuration. Authorize e-mail access one time and send a test mail to verify everything went well.
[[File:OAuth2InteractiveAuthorization.png|none|thumb|600x600px|/OAuth2InteractiveAuthorization.png|/OAuth2InteractiveAuthorization.png]]

== Gmail ==
1
[[File:GoogleSelectProject.png|none|thumb|600x600px|/GoogleSelectProject.png]]
2
[[File:GoogleCreateProject.png|none|thumb|600x600px|/GoogleCreateProject.png]]
3
[[File:GoogleProjectCreated.png|none|thumb|600x600px|/GoogleProjectCreated.png]]
4
[[File:GoogleEnabledApisServices.png|none|thumb|600x600px|/GoogleEnabledApisServices.png]]
5
[[File:GoogleApisServicesLibrary.png|none|thumb|600x600px|/GoogleApisServicesLibrary.png]]
6
[[File:GoogleApisServicesApiLibrary.png|none|thumb|600x600px|/GoogleApisServicesApiLibrary.png]]
7
[[File:GoogleGmailApis.png|none|thumb|600x600px|/GoogleGmailApis.png]]
8
[[File:GoogleAddGmailApi.png|none|thumb|600x600px|/GoogleAddGmailApi.png]]
9
[[File:GoogleGmailApiAdded.png|none|thumb|600x600px|/GoogleGmailApiAdded.png]]
1
[[File:GoogleCreateCredentialsHelpMeChoose.png|none|thumb|600x600px|/GoogleCreateCredentialsHelpMeChoose.png]]
2
[[File:GoogleCredentialsUserData.png|none|thumb|600x600px|/GoogleCredentialsUserData.png]]
3
[[File:GoogleOAuthConsentScreen.png|none|thumb|600x600px|/GoogleOAuthConsentScreen.png]]
4
[[File:GoogleOAuthScopes.png|none|thumb|600x600px|/GoogleOAuthScopes.png]]
5
[[File:GoogleScopeMailGoogleCom.png|none|thumb|600x600px|/GoogleScopeMailGoogleCom.png]]
6
[[File:GoogleScopeAuthGmailSend.png|none|thumb|600x600px|/GoogleScopeAuthGmailSend.png]]
7
[[File:GoogleScopes.png|none|thumb|600x600px|/GoogleScopes.png]]
8
[[File:GoogleOAuthClientID.png|none|thumb|600x600px|/GoogleOAuthClientID.png]]
9
[[File:GoogleRedirectURIs.png|none|thumb|600x600px|/GoogleRedirectURIs.png]]
1
[[File:GoogleClientCredentialsDownload.png|none|thumb|600x600px|/GoogleClientCredentialsDownload.png]]
2
[[File:GoogleOAuthConsentScreenSettings.png|none|thumb|600x600px|/GoogleOAuthConsentScreenSettings.png]]
3
[[File:GoogleConsentScreenWizard.png|none|thumb|600x600px|/GoogleConsentScreenWizard.png]]
4
[[File:GoogleAudienceExternal.png|none|thumb|600x600px|/GoogleAudienceExternal.png]]
5
[[File:GoogleContactInformation.png|none|thumb|600x600px|/GoogleContactInformation.png]]
6
[[File:GoogleTestUserAdded.png|none|thumb|600x600px|/GoogleTestUserAdded.png]]
7

8

File:OAuth2InteractiveGmail.png

2025-10-02T21:07:27Z

Tmo:

OAuth2 interactive Gmail

Howto16r1:Configure OAuth2 E-Mail

2025-10-02T21:01:38Z

Tmo:

File:GoogleTestUserAdded.png

2025-10-02T21:01:07Z

Tmo:

Test user added

File:GoogleContactInformation.png

2025-10-02T21:00:38Z

Tmo:

Contact information

File:GoogleAudienceExternal.png

2025-10-02T21:00:08Z

Tmo:

Audience external

File:GoogleConsentScreenWizard.png

2025-10-02T20:59:35Z

Tmo:

Consent screen wizard

File:GoogleOAuthConsentScreenSettings.png

2025-10-02T20:58:32Z

Tmo:

OAuth consent screen settings

File:GoogleClientCredentialsDownload.png

2025-10-02T20:57:52Z

Tmo:

Client credentials download

File:GoogleRedirectURIs.png

2025-10-02T20:57:15Z

Tmo:

Redirect URIs

File:GoogleOAuthClientID.png

2025-10-02T20:56:44Z

Tmo:

OAuth Client ID

File:GoogleScopes.png

2025-10-02T20:56:03Z

Tmo:

Scopes

File:GoogleScopeAuthGmailSend.png

2025-10-02T20:55:37Z

Tmo:

Scope auth gmail.send

File:GoogleScopeMailGoogleCom.png

2025-10-02T20:54:30Z

Tmo:

Scope mail.google.com

File:GoogleOAuthScopes.png

2025-10-02T20:53:45Z

Tmo:

OAuth scopes

File:GoogleOAuthConsentScreen.png

2025-10-02T20:53:16Z

Tmo:

OAuth consent screen

File:GoogleCredentialsUserData.png

2025-10-02T20:52:38Z

Tmo:

Credentials user data

File:GoogleCreateCredentialsHelpMeChoose.png

2025-10-02T20:52:04Z

Tmo:

Create credentials, help me choose

File:GoogleGmailApiAdded.png

2025-10-02T20:51:10Z

Tmo:

Gmail API added

File:GoogleAddGmailApi.png

2025-10-02T20:50:36Z

Tmo:

Add Gmail API

File:GoogleGmailApis.png

2025-10-02T20:50:04Z

Tmo:

Gmail APIs

File:GoogleApisServicesApiLibrary.png

2025-10-02T20:49:29Z

Tmo:

APIs Services API Library

File:GoogleApisServicesLibrary.png

2025-10-02T20:48:34Z

Tmo:

Apis Services Library