[GH-ISSUE #1655] Google OAuth Issue and .Env Issue #690

New issue

Open

opened 2026-02-25 21:35:41 +03:00 by kerem · 1 comment

kerem commented

2026-02-25 21:35:41 +03:00

Owner

Originally created by @abidkhanpk on GitHub (Sep 4, 2025).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/1655

Originally assigned to: @christer77 on GitHub.

Hi,

I had been looking for a web email client on which I can check all my email accounts simultaneously just like Thunder bird app on my mac. Cypht seems like it but it's been three days I couldn't make it work. Firstly, on local deployment, it gives me error messages again and again that .env file is missing which I don't want to use as it is unsecure and .env file can be viewed by just visiting mydomainname.com/webmail/.env which show all the content of it. I configured database.php file in config directory and it seems to work but still receiving .env file not found error but app is loading fine.

Second issue that I am facing is, it require composer which is not available on my shared webhosting plan. Is there a wayout for this?

Thirdly, on local deployment, when I try to login gmail account and click on enable, gmail page opens which gives this error:
Access blocked: Authorization Error
Error 400: invalid_request
Request details: flowName=GeneralOAuthFlow

Best Regards

Originally created by @abidkhanpk on GitHub (Sep 4, 2025). Original GitHub issue: https://github.com/cypht-org/cypht/issues/1655 Originally assigned to: @christer77 on GitHub. Hi, I had been looking for a web email client on which I can check all my email accounts simultaneously just like Thunder bird app on my mac. Cypht seems like it but it's been three days I couldn't make it work. Firstly, on local deployment, it gives me error messages again and again that .env file is missing which I don't want to use as it is unsecure and .env file can be viewed by just visiting mydomainname.com/webmail/.env which show all the content of it. I configured database.php file in config directory and it seems to work but still receiving .env file not found error but app is loading fine. Second issue that I am facing is, it require composer which is not available on my shared webhosting plan. Is there a wayout for this? Thirdly, on local deployment, when I try to login gmail account and click on enable, gmail page opens which gives this error: Access blocked: Authorization Error Error 400: invalid_request Request details: flowName=GeneralOAuthFlow Best Regards

kerem added the

awaiting feedback

label

2026-02-25 21:35:41 +03:00

kerem commented

2026-02-25 21:35:41 +03:00

Author

Owner

@jeremiah commented on GitHub (Sep 8, 2025):

Hey @abidkhanpk,

I understand the worry around your insecure .env file. You're right - it shouldn't be viewable from the web. This is why the instructions mention you put that file somewhere else on the file system than under document root. Have you considered putting it in "/usr/local/share/cypht/.env" for example?

With regard to missing composer, can you install software on your VPS or Shared Host?

Lastly, to help with the authorization error, more information is needed. You'll likely want to look into what GMail / Google requires to use OAUTH2. The secrets you're using ought to be checked as well to ensure they're aligned with your Google account but don't post them here. :-)

@jeremiah commented on GitHub (Sep 8, 2025): Hey @abidkhanpk, I understand the worry around your insecure .env file. You're right - it shouldn't be viewable from the web. This is why the instructions mention you put that file somewhere else on the file system than under document root. Have you considered putting it in "/usr/local/share/cypht/.env" for example? With regard to missing composer, can you install software on your VPS or Shared Host? Lastly, to help with the authorization error, more information is needed. You'll likely want to look into what GMail / Google requires to use OAUTH2. The secrets you're using ought to be checked as well to ensure they're aligned with your Google account but don't post them here. :-)