Your account

Your password, two-factor sign-in, the devices you're signed in on, app passwords for scripts, your language and interface style, your sign-in history, and notifications.

Everything on this page is in the account menu: click your name at the bottom of the list on the left. Its last line says which version of ThirtyFile the server runs, such as ThirtyFile 0.5.0.

Password

Change password asks for the current password and a new one. Your other devices are signed out afterwards. A new password needs at least 6 characters, or more if your administrator set a longer minimum.

When your administrator chose your password (a new account, or a reset), you choose your own the first time you sign in. Forgot it? Forgot password? on the sign-in page sends a link to your email address, if your administrator set up email and the site address, and your account has an address (Notification settings).

Two-factor sign-in

With two-factor sign-in, your password alone isn't enough: after it, sign-in asks for a six-digit code from an authenticator app on your phone, such as Microsoft Authenticator, Google Authenticator or 1Password. The code changes every 30 seconds and works only once.

1. Open Two-factor sign-in and choose Set up. Enter your password.
2. Scan the QR code with the app. If you can't scan it, type the key shown under it into the app.
3. Enter the code the app shows to confirm, and two-factor sign-in is on.
4. Save the ten recovery codes shown next, for example in a password manager or on paper. Each one signs you in once instead of a code, if you lose your phone. They are shown only this once.

From the same dialog you can create new recovery codes (the old ones stop working), move to another phone or app with Change app, or turn two-factor sign-in off. Each asks for your password and a code from your current app (or a recovery code).

• After five wrong codes you have to enter your password again. After ten wrong codes for one account, further codes are refused for up to 15 minutes.
• Single sign-on (Microsoft, Google, GitHub or an OpenID Connect provider) doesn't ask for a code: the provider has its own two-factor sign-in. App passwords don't ask for one either.
• If an administrator requires two-factor sign-in, you're asked to set it up right after your password the next time you sign in, and you can't turn it off.

Signed-in devices

Devices lists every browser signed in to your account: the browser and system, the address it last used, when it signed in and when it was last used. The one you're using is marked This device.

• Sign out next to a device ends its session right away. It has to sign in again.
• Sign out everywhere else signs out every device except this one.

A device that hasn't been used for 14 days is signed out, and every device is signed out 30 days after it signed in.

App passwords

Scripts, backup tools and file clients can't sign in through the sign-in page. Give each one its own app password under App passwords. This is also the way for accounts that sign in with single sign-on, which have no password of their own.

• Give it a name that says where it's used, choose whether it may only read files or also change them, and when it expires.
• Enter your current password, and with two-factor sign-in a code from your app. Accounts that sign in with single sign-on have no password to enter: they create app passwords within 10 minutes of signing in.
• You get a notification for every app password created for your account, so one you didn't create doesn't go unnoticed.
• The app password is shown once, right after you create it. Copy it then: only a fingerprint of it is kept, so nobody can show it again.
• The list shows when and from which address each one was last used. Remove one and whatever uses it stops working right away.

Send it in the Authorization header, or as the password of HTTP Basic sign-in together with your username:

curl -H "Authorization: Bearer tfa_…" https://drive.example.com/api/auth/me
curl -u "amy:tfa_…" -o report.pdf "https://drive.example.com/api/files/<file id>/content?download=1"

What the API answers

• Errors come as JSON: {"error": "…"}, a message in English, sometimes with a "code" for programs (such as upload_discarded).
• Status codes: 400 the request can't be done as asked (an invalid name, or a limit such as 50 app passwords); 401 not signed in, or the app password isn't valid; 403 you can see the item but may not do this with it; 404 not there, or not something you can see (an item you have no access to is "not found", so its existence isn't told); 409 a conflict (a name taken, something changed meanwhile); 413 too large for a limit or for the space; 429 too many at once, try again later; 507 the server's disk is short of room.
• Lists of a folder's items come as an array. With ?limit= they come a page at a time, as {"items": […], "next": "…"}: pass next as ?after= for the next page, until there is no next.

With an app password you can also open your files as a drive in File Explorer, Finder or your phone's Files app: see Mapping it as a drive.

App passwords work for files only: browsing, searching, downloading, uploading, and organising files and folders. They can't change your password, create app passwords, link sign-in methods, share links or use the Control panel, and they never get a cookie. One that may only read files is refused for anything that changes something.

Language

Language in the account menu changes the language ThirtyFile is shown in. Your choice is saved with your account, so your other computers and phones use it too once you sign in there. Until you choose one, you get the default language your administrator set, or your browser's language. The sign-in page and share links follow your browser, or the language picked in the list at their bottom.

Interface style

Interface style in the account menu decides how the file explorer is laid out and which keys do what. Automatic, the default, follows the computer you're on: the Mac style on a Mac, the Windows style on Windows, Linux and ChromeOS. Phones and tablets get the same layout in both styles. Your choice is saved with your account. The modifier key always follows your computer, whatever the style: ⌘ on a Mac, Ctrl elsewhere.

• Windows style: laid out like File Explorer, with an address bar, a folder tree and a command bar. Working with files describes it.
• Mac style: laid out like a Mac's Finder, with a sidebar in groups, a path bar, folders that expand in place in the List view, Quick look, and Finder's keys (Enter renames, ⌘ + ↓ opens). See The Mac style.

Both styles do the same things with your files, and ask the same questions before replacing or deleting anything.

Sign-in history

My sign-in history shows your sign-ins, failed attempts, sign-outs, password changes, and app passwords created, removed or used with a wrong secret, with the address and browser of each.

Notifications

The bell at the top right, next to the tabs, tells you about:

• Shared with you: someone shared a folder or file with you, or added you to a space, directly or through a group you're in. Access given to everyone isn't announced, and neither is a change to access you already had.
• Space almost full: a space you own or manage is 90% full. Your personal space counts, and so do team spaces where you're an owner or manager. You're told once, and again only after the space had room again.
• Access ending: access someone gave you ends within 3 days. When it was given with a shorter time to begin with, the share itself already said so.
• Files received through a link: someone uploaded files through a link you made that accepts files. Files that keep coming through the same link within an hour are counted in the same notification, which sends one email (also when you only get these by email).
• New app password: an app password was created for your account, with the address it was created from.
• New sign-in method: a single sign-on account (Microsoft, Google, GitHub or OpenID Connect) was linked to yours (Linking an account yourself).

A number on the bell counts the ones you haven't read. Click one to open what it is about. Mark all as read and Clear all are at the bottom of the list. Notifications are kept for 90 days.

Notification settings, at the bottom of the bell's list or in the account menu, turns each kind on or off, in the app and by email separately. Emails go to the email address you enter there. If you sign in with single sign-on, the address that account gives is filled in the first time, and you can change it. Leave it blank to get no emails. Password reset links go to this address too, so changing it asks for your current password (and with two-factor sign-in a code; accounts without a password change it within 10 minutes of signing in), and the previous address gets an email about the change. At most five emails of one kind go to an address within 15 minutes; the notifications in the app are all kept.