Authentication Checks by Connection Method
A Files.com account can use different credentials for browser sign-in, apps, and automated connections. The checks depend on the credential presented, not just the account's configured sign-in method. This distinction matters when assessing whether a two-factor authentication requirement covers a particular connection.
Sign-In and Later Connections
| Connection method | Authentication check | Where the second factor applies |
|---|---|---|
| Browser or API sign-in with a Files.com password | Files.com verifies the password and the account's applicable sign-in requirements. | Files.com checks the enrolled second factor when required. |
| Browser-based Single Sign-On | The identity provider authenticates the person; Files.com matches that identity to the configured account. | The provider applies its own requirements. Files.com applies its 2FA requirements unless the user is exempt. |
| Desktop or Mobile App | Browser sign-in establishes a dedicated app credential for later connections. | Required verification occurs during sign-in, rather than before every file operation. |
| API key, including a key used with FTP, SFTP, or WebDAV | Files.com verifies the key and its permitted access. | The key authenticates independently of password or browser-based 2FA. |
| Password over FTP, SFTP, or WebDAV | Files.com verifies the password and any applicable protocol authentication requirements. | When Files.com 2FA is required, a supported code accompanies the password unless the connection is exempt. |
| SSH key over SFTP | Files.com verifies the registered key. The password-and-key authentication method also requires the password. | Hardware verification on a supported SSH key is separate from Files.com-managed 2FA. |
The authentication method controls password and SSO sign-in. It does not revoke separately issued API or SSH keys. An SSO user can therefore have protocol access through a key without repeating the browser sign-in. LDAP and Active Directory can also authenticate passwords for supported protocols; other browser-based SSO providers require a separate credential for those connections.
Two-Factor Requirements
For sites using an identity provider's MFA, SSO exemptions prevent duplicate Files.com prompts. The exemption concerns the Files.com challenge; the identity provider still controls its own authentication requirements.
A hardware-backed SSH key can require physical interaction before the private key is used. This does not enroll the account in Files.com 2FA or satisfy a Files.com-managed 2FA requirement. Key-only SFTP access for an account with that requirement needs the appropriate protocol exception.
Access After Authentication
Authentication establishes which account or key is connecting. It does not add permissions. User credentials remain subject to the user's access and the applicable protocol and IP restrictions; site-wide API keys have their own site and Workspace scope. API key permission scopes can further limit what a connection can do.
The app sign-in checks govern how a new app connection is established. Credential and session revocation governs whether established access can continue.