A redesigned onboarding screen shipped with a broken first step, and nobody had noticed: every tester had already granted consent with their own Google account, so the first-sign-in path never ran. Dedicated Gmail test accounts close that gap by giving each role and environment its own Google identity.
This guide to Gmail accounts for QA testing covers which scenarios need them, how many a CI matrix needs and which ones can be cheap. Some teams create every account themselves; others source aged Gmail accounts. Read the limits section first, because bought accounts carry extra risk.
Why Developers Need Dedicated Gmail Test Accounts
Testing with your own login causes three problems that separate test Google accounts for developers avoid:
- Polluted test data - an existing user record and stored grant mean first-sign-in flows never truly run.
- A real account at risk - staging builds handle tokens in unfinished code, and sign-ins from CI runners can trigger security challenges on an account you rely on.
- No role separation - one person cannot be owner, guest and invitee at once, so roles get edited in the database instead of tested.
AI assistants that request Gmail or Drive scopes deserve the same caution, and our post on Gmail accounts for AI tools covers keeping AI sign-ups off your main account.
QA Scenarios That Need Separate Gmail Accounts
Sign in with Google and OAuth consent
Sign in with Google and One Tap change with the number of sessions in the browser, prior grants and recent dismissals, which start a cooldown. You need several Google sign-in test accounts: one new to your app, one returning, and a browser holding several sessions to exercise the chooser. Key users on sub, not email, and remember that consumer Gmail accounts carry no hd claim.
In Testing status, only listed OAuth test users can authorise your app. Google's Manage App Audience help page caps the list at 100, counts each user toward that cap once added, and expires test-user grants after seven days unless the app requests only name, email and profile scopes.
Firebase account linking
Unit tests belong in Firebase's Local Emulator Suite, but test linking end to end on staging: a user registers with email and password, then signs in with Google using the same @gmail.com address. The outcome depends on your linking setting. Firebase treats Google as a trusted provider for Gmail addresses, so an unverified password sign-in can be removed, while the "multiple accounts for each identity provider" setting creates a second user. Test each path.
Tenant roles and Play license testing
Multi-tenant products need an owner, admin, member, guest and refused outsider in two tenants that each fail to read the other's data. Android teams also add Gmail addresses to Play Console's License testing list so in-app purchases run with test payment methods instead of real charges.
Email rendering and seed inboxes
A seed list of Gmail accounts for email testing shows whether receipts clip beyond roughly 102KB and which tab mail lands in. Treat placement as directional, since sorting reacts to engagement (see our explainer on Gmail's Most Relevant Promotions tab). If your harness cannot read seed inboxes, try our fix for Gmail IMAP errors in third-party apps or use the Gmail API.
When Brand-New Gmail Accounts Break CI Runs
Accounts built for one signup, linking or delete-and-recreate test can be young and cheap, because they are wiped before age matters. Long-lived identities are different: CI logins, license testers, seed inboxes and tenant owners.
Brand-new accounts can meet extra verification or phone prompts, and a run stalled by a challenge unrelated to your code is a false failure that teaches teams to ignore red builds. Established accounts may meet fewer new-account restrictions, which is why some teams use aged Gmail accounts for developers in long-lived roles. But a new device, location or cloud IP, or a password and recovery change, can trigger a challenge on any account - and a handed-over account meets all of those on day one.
So sign each account in once, by hand, save the session (Playwright's storage state or Cypress's cy.session()) and reuse it. If a challenge still appears, mark the build as blocked, clear it manually and refresh the session.
Organising a Gmail Test Account Pool
A pool of Gmail accounts for software testing that lives in one engineer's head collapses when that person is away. Six rules keep it maintainable:
- Name everything. Store a label such as
stg-tenantA-admin-01beside each address. - Use a vault, not a spreadsheet. Keep password, recovery email and label in a secrets manager with tightly limited access.
- One account per role per environment. The staging admin is never the production smoke-test admin.
- Rotate deliberately. Change passwords when people leave and retire accounts whose app state can no longer be reset.
- Put recovery under team control. A shared QA group address as the recovery email lets any on-call engineer clear a challenge; see our guide to Gmail accounts with recovery email and full access.
- Never promote test accounts. A test identity must never become a real customer or live admin.
What Gmail Test Accounts Are Not For
Start with the biggest limit: Google has said publicly that buying, selling or trading Gmail accounts violates its policies, so a purchased account can be disabled at any time. Never let a critical CI job depend on a single bought account; keep a fallback identity, ideally one your team created.
Google Play requires newer personal developer accounts to run a closed test - currently at least 12 testers opted in for 14 continuous days - before production access. Filling that count with bought accounts, or idle accounts you control, misrepresents your testing to Google. Recruit genuine testers.
Nor should test accounts supply installs, ratings or reviews, or load-test Google's sign-in pages. Google and the app stores penalise spam and coordinated inauthentic activity, and test pools are no exception.
How Many Gmail Test Accounts Your CI Matrix Needs
Before you buy Gmail accounts for testing or create them, multiply roles by environments by parallel CI workers. Five roles, two environments and two workers make 20 identities. Add a spare worker set (10) so a lockout never blocks a run, plus a few throwaway signup accounts, and you reach about 35.
| Team | Suggested Pool | What Drives the Count |
|---|---|---|
| Indie developer or startup | 8-12 | 3-4 roles, one environment, one worker |
| Product team with CI | 30-40 | 5 roles, 2 environments, 2 workers |
| QA organisation | 50-120+ | Several products, environments and workers |
OldGmb prices bulk Gmail accounts for testing by age, so match the tier to each account's lifespan. Login and recovery details reach your Telegram chat, usually within minutes, and an account that stops working within 48 hours of delivery because of an issue on our side is replaced.
| Account Age | Price | Best Test Use |
|---|---|---|
| 6 months | $1 | Throwaway signup and linking tests |
| 1-2 years | $2 | Guest and member roles |
| 3-4 years | $3 | Staging roles and personas |
| 5-8 years | $4 | CI logins, license testers |
| 9-11 years (most popular) | $5 | Email seed inboxes, smoke tests |
| 12-15 years | $6 | Long-lived tenant owners |
That 35-account example - 30 accounts at 3-4 years plus five at 6 months - costs $95. Buy one environment's roles first, run your sign-in suite for a week, then order the rest.
Frequently Asked Questions
Can I use Gmail plus-addressing instead of separate test accounts?
Only for flows that just need a distinct address, such as email-and-password signup. Every plus alias reaches one inbox and one Google account, so Sign in with Google, OAuth consent and Firebase linking need genuinely separate accounts.
How do I see the first-sign-in consent screen again on a test account?
Remove your app from the test account's third-party connections in its Google Account settings, delete the matching user in your backend and clear the browser session. For a quick look, adding prompt=consent to the authorisation request shows the consent screen again.
Do CI test accounts need 2-Step Verification?
Turning it on is sensible, but do not script the second factor on every run. Sign in once by hand, let CI reuse the saved session, and keep the TOTP seed and backup codes in the vault for when a session expires.
Do I need consumer Gmail or Google Workspace test users?
Consumer Gmail covers apps open to any Google account. If you restrict sign-in by domain or publish an Internal OAuth app, add Workspace test users too: they carry the hd claim, only your organisation's users can use an Internal app, and Workspace admins can block third-party app access.
Next Step: Map Your Test Roles Before You Order
Before ordering or creating anything, list every role, environment and parallel CI worker, count the cells and add spares. That matrix becomes the naming scheme, vault layout and order list for your Gmail test accounts.
Ready to fill it in? See every age tier on the OldGmb product page, or send your matrix to Telegram @oldgmb and we will suggest a tier for each row.
