Device Accounts

A device account is the username and password another device signs in with. It is the credential for the network drive, for git, for protected websites and for camera feeds. There is no anonymous or shared login, so every sign-in belongs to one account. Content you set to public is the exception, as a visitor reads that without signing in at all.

The first account

A fresh install has no accounts. When a device tries to sign in to the network drive for the first time, the Share tab notices and offers to create that account. The username comes from the attempt and you pick the password on the server. When a git client makes first contact instead, an account named nasreborn with a strong generated password is created for it, so the credentials a git app points you to always exist. You manage accounts under Settings → Authentication on the server, where a password is revealed with Face ID, Touch ID or the device passcode and copies with a tap. One account is enough if you are the only user.

Why make more than one

A new account reads and writes everything the server shares, so the reason to create more than one is usually revocation rather than permissions. Each person or each machine gets a login you can revoke later without touching the others, and each account shows when it was last used so you can spot a stale one. The free tier includes one account and more come with the Pro unlock, so each member of the household can have their own.

Narrowing what an account reaches

You can also limit an account to part of the server. On its screen, turn All content off and tick the folders, repositories and camera feeds it may reach. The list starts out with everything that exists right now, so switching it off takes nothing away immediately. Anything added later stays out until you tick it as well. One list covers every protocol at once and there is no separate setting for the network drive, for S3, for git and for the web.

What an account cannot reach behaves as if it were not there. The share does not appear on the network drive and does not mount when it is typed in by hand, the folder is missing from S3 listings, and a repository or feed answers a plain 404. Nothing announces a refusal, since that would confirm what is hidden. Changing the scope of an account also disconnects sessions it has already mounted, because a network drive only checks the share name when it first connects.

Narrowing is available on every tier. It can only take authority away from a credential and never add any.

Creating an account

In Settings → Authentication, tap Add Account. Usernames are short and lowercase and can contain letters, digits and . _ -. You type a password or let the app suggest a strong one built from unambiguous characters that are easy to type into a login sheet on another screen. The app warns you about weak passwords but leaves the choice to you.

Git tokens

Once the server hosts a git repository, a Git Tokens section appears on the screen of each account. These are long random strings that stand in for the password when a git client or a script signs in, and each of them is revoked on its own. You can read about creating and using them under API tokens on the git repositories page.