534 5.7.9: app password required
The account uses 2-Step Verification, so Google will not accept its normal password from your mail client and asks for an app password instead.
- Gmail
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 534 5.7.9
- Provider
- Gmail and Google Workspace
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
534 5.7.9 Application-specific password required.
What it means
With 2-Step Verification on, an app that signs in with the account's normal password cannot complete the second step, so Google refuses it with this reply and asks for an application-specific password, usually called an app password: a separate password generated for one app. Google links the reply to its help on signing in with app passwords. OAuth sign-in is the alternative where the app supports it. Google's current table prints this code as 5.7.90; the June 2025 version read 5.7.9, which this entry uses.
Common causes
- The account has 2-Step Verification on and the app signs in with the normal password.
- An app password stopped working, for example after the account's password was changed.
How to fix it
- 01Create an app password in the Google Account security settings, and enter it in the app instead of the normal password.
- 02If the option is missing, check that 2-Step Verification is on; accounts managed by an organization may not offer app passwords.
- 03Prefer OAuth sign-in if the app offers it.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Gmail SMTP errors and codes (Google Workspace Admin Help)knowledge.workspace.google.com
- Gmail SMTP errors and codes, version of June 2025 (Internet Archive copy)web.archive.org
Related codes
- 535 5.7.8Username and password not accepted.Google rejected the user name and password your client used to sign in to its SMTP server, so it will not send mail for it.
- 534 5.7.9Sign in with a web browser first.Google refused your client's SMTP sign-in and wants the account owner to sign in through a web browser first, where Google can run its checks.
- 534Authentication method too weak.The server refused the login because the authentication method the client chose is weaker than its policy allows for this user.
- 534 5.7.9Authentication method too weak.The server refused the login because the chosen authentication method is weaker than its policy allows for this user; the client should pick a stronger one.
All 108 Gmail codesEvery code in the wikiPaste your own bounce