An app password is a separate set of credentials for a program that connects to FileRun without a browser: a WebDAV client, the desktop sync app, a mobile app, or any other tool that reaches your files directly.
Your normal FileRun password does not work for these programs. It is refused whatever your account settings are. Only an app password is accepted.
You do not always have to make one yourself. Which of the two ways below applies depends on what the program asks you for when you set it up.
The desktop sync app and the Nextcloud mobile apps work this way. You give them the address of your FileRun installation, they open FileRun in your browser, and you approve the connection there with one click.
FileRun creates the app password itself at that moment and hands it straight to the program. You never see it, and there is nothing to prepare in advance.
The connection then appears under Account settings → Connected apps, like any other, and you can
revoke it from there. An entry made this way is called App, unless your administrator changed the
default name, and it records which program asked for it.
Any other WebDAV client works this way. It cannot send you to a browser, so it needs credentials you type in yourself, and this is when you create an app password by hand.
Make one for each device or program, and do not use the same one in two places. That way you can cut off a single device later without disturbing the others.
Connect app.
You can also open Account settings → Connected apps and click Connect app there.Work laptop or My phone.The window that appears gives you everything the program needs:
Username — note that this is not your login name. It is an identifier of your account, and
it is the value the program expects.Password — the app password itself.Connection URL via WebDAV — the address for a WebDAV client.Connection URL via desktop or mobile app — the address for the desktop sync app and the mobile
apps.Show QR code — a code you can scan with a mobile app instead of typing anything.The password is shown once and never again. Copy it into the program before closing the window. If you lose it, revoke the entry and create a new one; there is no way to read it back.
Account settings → Connected apps lists everything connected to your account: the credentials you
created yourself, the ones FileRun created for an app you approved in the browser, and the
applications authorized through FileRun's API. Each entry shows its name, when it was added and the
IP address it was created from.
Browser sessions are not listed here. Those are under Sessions.
Click the button on the entry's row and confirm. The program using it loses access at once, and will ask for credentials again.
Revoke an entry whenever you stop using a device, when you lose one, or when you do not recognize it.
An app password expires two years after it was created, unless your administrator configured a different period. FileRun removes expired ones by itself, and the program that used one simply stops being able to connect. Create a new one and enter it in the program.
A WebDAV client or a sync app cannot show you a code prompt or ask for your fingerprint, so it never goes through your second factor. An app password grants access to your files on its own.
This is why the advice above matters: one app password per device, and revoke the ones you no longer use. When you create one by hand, FileRun asks you to verify your identity first, precisely because what comes out of it bypasses the second factor afterwards. When an app asks for your FileRun address instead, what protects the account is the sign-in you go through in the browser, second factor included.
Two more points:
Guest accounts cannot use app passwords by either route: the Connect app option is not offered to
them, and approving an app in the browser is refused as well. Guests reach their files through the
web interface only. See Guest accounts.