Using FileRun

App passwords🔗

An app password is a separate set of credentials for a program that connects to FileRun without a browser: a WebDAV client, the desktop sync app, a mobile app, or any other tool that reaches your files directly.

Important

Your normal FileRun password does not work for these programs. It is refused whatever your account settings are. Only an app password is accepted.

You do not always have to make one yourself. Which of the two ways below applies depends on what the program asks you for when you set it up.

When the program asks for your FileRun address🔗

The desktop sync app and the Nextcloud mobile apps work this way. You give them the address of your FileRun installation, they open FileRun in your browser, and you approve the connection there with one click.

FileRun creates the app password itself at that moment and hands it straight to the program. You never see it, and there is nothing to prepare in advance.

The connection then appears under Account settings → Connected apps, like any other, and you can revoke it from there. An entry made this way is called App, unless your administrator changed the default name, and it records which program asked for it.

When the program asks for a username and a password🔗

Any other WebDAV client works this way. It cannot send you to a browser, so it needs credentials you type in yourself, and this is when you create an app password by hand.

Make one for each device or program, and do not use the same one in two places. That way you can cut off a single device later without disturbing the others.

1. Click your name in the bottom left corner of the interface and choose Connect app. You can also open Account settings → Connected apps and click Connect app there.
2. Give it a name that tells you which device it is for, such as Work laptop or My phone.
3. FileRun asks you to confirm your identity, and then shows the credentials.

The window that appears gives you everything the program needs:

• Username — note that this is not your login name. It is an identifier of your account, and it is the value the program expects.
• Password — the app password itself.
• Connection URL via WebDAV — the address for a WebDAV client.
• Connection URL via desktop or mobile app — the address for the desktop sync app and the mobile apps.
• Show QR code — a code you can scan with a mobile app instead of typing anything.

Important

The password is shown once and never again. Copy it into the program before closing the window. If you lose it, revoke the entry and create a new one; there is no way to read it back.

Where they are listed🔗

Account settings → Connected apps lists everything connected to your account: the credentials you created yourself, the ones FileRun created for an app you approved in the browser, and the applications authorized through FileRun's API. Each entry shows its name, when it was added and the IP address it was created from.

Browser sessions are not listed here. Those are under Sessions.

Revoking one🔗

Click the button on the entry's row and confirm. The program using it loses access at once, and will ask for credentials again.

Revoke an entry whenever you stop using a device, when you lose one, or when you do not recognize it.

How long they last🔗

An app password expires two years after it was created, unless your administrator configured a different period. FileRun removes expired ones by itself, and the program that used one simply stops being able to connect. Create a new one and enter it in the program.

App passwords and two-factor authentication🔗

A WebDAV client or a sync app cannot show you a code prompt or ask for your fingerprint, so it never goes through your second factor. An app password grants access to your files on its own.

This is why the advice above matters: one app password per device, and revoke the ones you no longer use. When you create one by hand, FileRun asks you to verify your identity first, precisely because what comes out of it bypasses the second factor afterwards. When an app asks for your FileRun address instead, what protects the account is the sign-in you go through in the browser, second factor included.

Two more points:

• Changing your password does not revoke your app passwords. They keep working. If you suspect somebody else had access to your account, revoke them yourself.
• Resetting a forgotten password does revoke them all. After a password reset you have to reconnect every device.

Guest accounts🔗

Guest accounts cannot use app passwords by either route: the Connect app option is not offered to them, and approving an app in the browser is refused as well. Guests reach their files through the web interface only. See Guest accounts.