--- title: "Gmail sending limits and API scopes for AI agents" description: "What an AI agent sending through Gmail runs into: daily sending limits, Gmail API quota units, and restricted scopes that need a yearly security review." url: https://www.unitpost.com/blog/agents/gmail-limits-for-ai-agents section: Blog updated: 2026-11-02 --- # Gmail sending limits and API scopes for AI agents An agent sending through a Gmail account hits the account's limits: 500 emails a day on personal Gmail and 2,000 on Google Workspace, then a block of up to 24 hours. Through the Gmail API each send costs 100 quota units, and reading mail needs restricted scopes that public apps must pass Google's verification and a yearly security assessment to use. Mail an agent sends for your product belongs on your own domain. ## Gmail sending limits and API scopes for AI agents > What an AI agent sending through Gmail runs into: daily sending limits, Gmail API quota units, and restricted scopes that need a yearly security review. Connecting an agent to a Gmail account is the quickest way to let it send: one OAuth consent and it writes as you. It's also where agents run into limits built for one person typing, not a loop that sends. ### What are Gmail's sending limits? Per account, from Google's own pages: - Personal Gmail: 500 emails a day, or 500 recipients in a single email. Past that the account sees "You have reached a limit for sending mail" and can usually send again within 1 to 24 hours (Gmail sending limits (https://support.google.com/mail/answer/22839)). - Google Workspace, per user: 2,000 messages a day (1,500 for mail merge, 500 on a trial account); 2,000 recipients per message, at most 500 of them external, and 500 for a message sent through the Gmail API; 10,000 recipients a day in total, 3,000 of them external. Over a limit, sending is blocked for up to 24 hours (Workspace sending limits (https://knowledge.workspace.google.com/admin/gmail/gmail-sending-limits-in-google-workspace)). The block is per account, not per agent. When an agent burns the day's limit at 10 a.m., the person who owns the mailbox can't send either. ### What does the Gmail API cost in quota? The Gmail API counts quota units, not messages. `messages.send` costs 100 units, `messages.get` 20 (60 for the full or raw message) and `messages.list` 5. A project gets 6,000 units a minute per user, so one user's agent can send at most 60 messages a minute before reading anything, and 1,200,000 units a minute across the project. For Cloud projects created from 1 May 2026, usage over 80,000,000 units a day per project is billed (Gmail API quota (https://developers.google.com/workspace/gmail/api/reference/quota)). The account's daily sending limits above still apply on top of the API quota. ### Which Gmail scopes does an agent need, and what review comes with them? What the agent does decides the scope, and the scope decides Google's review (Gmail API scopes (https://developers.google.com/workspace/gmail/api/auth/scopes)): - Send only: `gmail.send` is a sensitive scope. A public app needs Google's verification. - Read, draft or label mail: `gmail.readonly`, `gmail.compose`, `gmail.modify`, `gmail.metadata` and full access (`https://mail.google.com/`, which also covers IMAP, SMTP and POP) are restricted. A public app that stores or transmits that data from its servers must pass verification and a security assessment, repeated every 12 months (restricted scope verification (https://support.google.com/cloud/answer/13464325)). - Exempt: personal-use apps with fewer than 100 users, and apps internal to one Workspace organization. An agent that answers replies needs to read the inbox, so it needs a restricted scope, and with it access to everything else in that mailbox: invoices, password resets, the CEO's thread. > **One mailbox, one blast radius:** A prompt injection in an inbound email runs with whatever the agent's scope allows. With full Gmail access, that is the whole mailbox (how to defend against it (/blog/agents/protect-ai-email-agent-prompt-injection)). ### What should an agent send from instead? For mail your product or business sends, give the agent its own address on a domain you control, such as `agent@mail.example.com`: - Sending goes through an email API with a key that can only send (which permissions (/blog/agents/api-key-permissions-for-ai-agents)). The domain's SPF, DKIM and DMARC are yours, so receivers can authenticate the mail. - Replies arrive at that address and reach the agent as webhooks, without access to anyone's mailbox (set it up (/blog/agents/ai-agent-reply-to-inbound-email)). - Limits are the sending plan's, not a person's account, and a stuck agent can be stopped by revoking one key without touching anyone's email. Keep a person's Gmail for agents that act as that person, for that person: drafting their replies, sorting their inbox. That's the job OAuth to a mailbox is for. ## FAQ ### How many emails can an agent send from a Gmail account a day? Personal Gmail allows 500 emails a day, or 500 recipients in one email. Google Workspace allows 2,000 messages a day per user (1,500 for mail merge, 500 on a trial), with at most 10,000 recipients a day, 3,000 of them external. ### What happens when an agent hits the Gmail limit? Sending stops with "You have reached a limit for sending mail". Personal accounts can usually send again within 1 to 24 hours; Workspace blocks sending for up to 24 hours. Every message the agent tries in the meantime fails, including the ones a person sends from the same account. ### Does sending through the Gmail API need a security assessment? gmail.send alone is a sensitive scope: it needs Google's app verification but not the assessment. Reading, drafting or modifying mail (gmail.readonly, gmail.compose, gmail.modify or full access) uses restricted scopes, and a public app that stores or transmits that data from its servers needs a security assessment every 12 months. Personal-use apps under 100 users and Workspace internal apps are exempt from verification. ### Can an agent send as a Gmail address through another provider? Not in a way receivers trust. A provider can't sign mail with DKIM for gmail.com, and gmail.com's DMARC policy tells receivers what to do with mail that fails, so it lands in spam or bounces. Send from a domain you control. ## Related - [How email webhooks work (they're POST)](https://www.unitpost.com/blog/concepts/how-email-webhooks-work): An email webhook is an HTTP POST to your URL when a message is delivered, bounced, opened, or clicked — not polling, not IMAP. - [OAuth or API key: how to connect an AI agent to an MCP server](https://www.unitpost.com/blog/agents/mcp-oauth-vs-api-key): What the MCP spec says about OAuth, how Unitpost's hosted server signs a person in, what consent grants, and when a scoped API key fits better. - [MCP server, SDK or REST API: how should an AI agent send email?](https://www.unitpost.com/blog/agents/mcp-vs-api-for-agent-email): The same email send over MCP, an SDK and REST: when each fits, OAuth vs API keys, and why scopes, limits and errors match on all three.