Guide

List Yahoo Mail from Terminal (No App Passwords)

Yahoo Mail's IMAP access requires generating app-specific passwords, configuring IMAP settings manually, and dealing with Yahoo's security blocks. The Nylas CLI handles OAuth2 and provider abstraction behind the scenes — authenticate once, then list, search, and read emails with a single command. Also works with Gmail, Outlook, Exchange, iCloud, and IMAP.

Written by Pouya Sanooei Software Engineer

Reviewed by Caleb Geene

Verified — CLI 3.1.1 · Yahoo Mail · last tested April 11, 2026

Yahoo Mail in 2026: 225 million users, tighter security

According to Statista's 2024 email client market share report, Yahoo Mail still serves 225 million monthly active users — making it the third-largest consumer email provider behind Gmail and Outlook. That's a lot of inboxes that scripts, cron jobs, and AI agents need to reach.

Yet accessing those inboxes programmatically got harder after the 2013-2014 breaches that exposed all 3 billion Yahoo accounts. Yahoo responded by disabling plain IMAP passwords entirely in 2020, requiring app-specific passwords generated through Yahoo's account security page. There is no official CLI or REST API for consumer Yahoo Mail accounts, and tools like fetchmail or mutt still depend on that app-password workflow.

1. Install the Nylas CLI

brew install nylas/nylas-cli/nylas

See the getting started guide for alternative install methods (Go, shell script, PowerShell).

2. Connect your Yahoo Mail account

Head to dashboard-v3.nylas.com, create an application, and connect your Yahoo Mail account. Then grab your API key:

nylas auth config
# Paste your API key when prompted

# Verify the connection
nylas auth whoami
# => Authenticated as you@yahoo.com (Yahoo)

3. List your emails

Once authenticated, listing works the same regardless of provider:

nylas email list
nylas email list --limit 10
nylas email list --unread

Yahoo's web search is decent, but it can't be scripted. From the terminal:

# Search by keyword
nylas email search "receipt" --limit 5

# Search by sender — useful for Yahoo notification noise
nylas email search "from:notifications@yahoo.com"

# Date range
nylas email search "after:2026-01-01 before:2026-02-01"

5. Read a specific email

nylas email read msg_abc123
nylas email read msg_abc123 --mime

6. JSON output for scripting

Pipe --json output into jq for scripting or AI agent consumption:

# Count unread Yahoo emails
nylas email list --unread --json | jq length

# Extract subjects and senders
nylas email list --limit 5 --json \
  | jq -r '.[] | "\(.from[0].email): \(.subject)"'

7. Work with Yahoo Mail folders

Yahoo Mail uses "Bulk Mail" where Gmail says "Spam" and Outlook says "Junk Email." If you're writing scripts that work across providers, this naming difference matters:

# Yahoo's spam folder is called "Bulk Mail"
nylas email list --folder "Bulk Mail" --limit 5

# List all folders to see Yahoo's naming conventions
nylas email folders list

# Other Yahoo default folders
nylas email list --folder "Draft"
nylas email list --folder "Sent"

Custom folders created in Yahoo's web UI appear here too. The CLI normalizes folder IDs across providers, so scripts that reference folder IDs (not display names) work without provider-specific branches.

8. Yahoo security timeline and what it means for CLI access

Yahoo's security posture changed dramatically after two breaches. In 2013, attackers compromised all 3 billion Yahoo accounts — the largest data breach in history at the time. A separate 2014 breach exposed another 500 million accounts. According to Yahoo's 2017 SEC filing, the company wasn't fully aware of the 2013 breach scope until Verizon's acquisition due diligence in 2016.

The fallout reshaped how Yahoo handles third-party access:

YearChangeImpact on CLI/scripting
2016Mandatory 2FA rollout for high-risk accountsPlain IMAP login blocked for 2FA users
2020Yahoo disabled plain IMAP passwords entirelyAll IMAP users must generate app-specific passwords
2023App password UI buried under Account Security > Other ways to sign inHarder to find, more users locked out

The Nylas CLI sidesteps all of this. It authenticates through Yahoo's official OAuth2 flow — the same mechanism Yahoo's own mobile app uses. No app passwords, no IMAP server config (imap.mail.yahoo.com:993), no "suspicious login" blocks.

9. Yahoo Mail variants and carrier accounts

Yahoo powers email for several ISP and carrier brands. AT&T migrated its email infrastructure to Yahoo in 2017, so @att.net, @sbcglobal.net, and @bellsouth.net addresses all route through Yahoo's backend. The same applies to legacy Verizon accounts. The CLI handles all of them:

  • Yahoo Mail — @yahoo.com, @ymail.com, @rocketmail.com
  • AT&T Yahoo Mail — @att.net, @sbcglobal.net, @bellsouth.net, @pacbell.net
  • Verizon Yahoo Mail — legacy @verizon.net accounts migrated to Yahoo
  • Yahoo Small Business — custom domain email hosted on Yahoo

All of these authenticate through the same OAuth2 flow. No special configuration needed.

Important exception: Yahoo Japan (@ymail.ne.jp, @yahoo.co.jp) is a separate company with a separate auth system. It is not supported through the same OAuth flow and requires a different grant configuration.

Next steps