LightDrive provides separately revocable credentials for connected apps and devices. Use a separate credential for each app or device when practical, and choose only the services that app needs.
Vault app passwords
Use a Vault app password with Files, Calendar, and other Vault services when a client cannot complete browser sign-in or two-factor authentication.
- Open Settings → Security → App & device access.
- Under Vault app passwords, enter a name that identifies the app and device.
- Select Create Vault app password and copy the value immediately.
- Enter it in the compatible Vault client in place of your main password.
A Vault app password does not provide access to LightDrive Email or CardDAV Contacts.
LightDrive client passwords
For external email, contacts, calendar, and task apps, LightDrive can create a LightDrive client password limited to the services that app needs. It does not grant Files access. Available access combinations include:
- Email only
- Contacts only
- Calendars only
- Email & contacts
- Email & calendars
- Contacts & calendars
- Email, contacts & calendars
For example, an email app that only uses IMAP and SMTP should normally receive an Email only password. An app such as Thunderbird that uses email, contacts, and calendars can use one Email, contacts & calendars password for all three services.
- Open Settings → Security → App & device access.
- Enter a name that identifies the app or device.
- Choose the narrowest service combination the app requires.
- Select Create client password and copy the value immediately.
- Enter that client password into each enabled LightDrive service used by the app.
External email clients require a client password that includes Email; your main LightDrive password and Vault app passwords do not authenticate to IMAP or SMTP.
Calendar clients may use your main LightDrive password, a Vault app password, or a LightDrive client password that includes Calendars. Compatible Tasks/CalDAV clients also use the Calendars scope. For third-party calendar and task apps, a separately revocable client password is generally preferable.
Contacts clients require a LightDrive client password that includes Contacts. Your main LightDrive password and Vault app passwords do not authenticate to the LightDrive CardDAV service.
Each client-password value is shown only when it is created. If you lose it, revoke it and create another. Naming each credential for one app and device makes it easier to remove access later without interrupting other connections.
Revoking a Vault app password or client password does not change your main LightDrive password. Treat every credential as a secret and use it only for the access shown when it was created.