topic Re: Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP in Discussions

Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

jcoles — Wed, 25 Feb 2026 20:55:13 GMT

Thunderbird 148 introduces PKCE, a more secure auth protocol. This should not have been done without warning as I have now lost access to email. Where are the instructions on how to set up PKCE?

My email is Yahoo with IMAP protocol. I use OAuth2 authentication. I see no PKCE option in the security settings.

Re: Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

wsm — Wed, 25 Feb 2026 21:37:14 GMT

As https://support.mozilla.org/en-US/kb/thunderbird-and-yahoo indicates, login prompts should be expected because Oauth tokens are subject to expiration/renewal by the mail provider at any time.

Re: Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

jcoles — Wed, 25 Feb 2026 21:46:15 GMT

But it rejects my password!

I have changed mailnews.oauth.usePrivateBrowser to true as you suggested, but I'll have to try login again later. I'm currently locked out for 30 minutes.

Important rule: Updates must never break anything.

Re: Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

wsm — Wed, 25 Feb 2026 22:00:29 GMT

> But it rejects my password!

Does your password still work for web access?

Re: Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

jcoles — Wed, 25 Feb 2026 22:40:48 GMT

Web access to what? Webmail? Attempts to access Yahoo webmail take me to Rogers Member Centre which also rejects the password. This might be a Rogers issue. Temporary I hope. I'll have to leave this for tomorrow. Too complex and stressful. Perhaps I'll just restore the older, usable Thunderbird.

Re: Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

wsm — Wed, 25 Feb 2026 23:08:25 GMT

Thanks for the info. FYI I have closed comments in the other discussion thread.

If your password fails in webmail, then what hope is there for the password to be accepted through Thunderbird?

If the password is no longer good then you'll need to reset it.

Re: Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

wsm — Thu, 26 Feb 2026 11:12:59 GMT

Any luck?

Re: Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

jcoles — Thu, 26 Feb 2026 12:15:07 GMT

Yes. Resetting the Rogers password fixed the problem. Should I click "Accept as solution"? If so, where? No single posting contains the whole context.

Rogers member centre, which I rarely visit, has stopped recognizing my password before, and it's the member centre login that TB 148 was demanding in the popup window I showed you before. The password cannot really have been invalid as TB on my Android phone and TB 147 on my laptop never lost email access.

Perhaps the password reset has done something in OAuth2, which Rogers/Yahoo imposed on us a few years ago. I understand it's a hidden additional password layer and I remember it was tricky to set up and get working. Technology grows ever more convoluted and opaque. Eventually only hackers will be able to use it.

Re: Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

wsm — Mon, 02 Mar 2026 06:03:00 GMT

> Important rule: Updates must never break anything.

Some triggered Rogers to renew your authentication token - Oauth tokens are subject to expiration/renewal by the mail provider at any time. That it happened during an update suggests that maybe they will require it again - not likely anything Thunderbird can do about it.

Re: Please explain how to set up Thunderbird PKCE authentication for Yahoo IMAP

jcoles — Mon, 02 Mar 2026 12:47:59 GMT

Yes, it was a confusing coincidence. Rogers' password reset process, secured with a texted code, resolved the problem.