Credentials and Access Revocation
Ending access requires changing the credential, session, or account that authorizes it. Signing out of one session, changing a password, and disabling an account have different effects because an account can have several independent ways to connect.
Scope of Access Removal
| Action | Effect |
|---|---|
| Sign out of a web session | Ends that session. Other sessions and independently issued credentials remain separate. |
| Change a Files.com password | Invalidates other existing login sessions. API keys and SSH keys remain issued and can authenticate separately. |
| Delete an API key | Prevents further use of that key, including sessions associated with it. Other keys remain usable. |
| Delete an SSH key | Prevents further authentication with that key and invalidates sessions associated with it. Other credentials remain separate. |
| Revoke a Desktop App connection | Ends that app connection and requires a new sign-in. |
| Disable a Files.com user | Blocks the user's authentication and invalidates the user's existing login sessions, including access through user API keys and SSH keys. |
| Revoke a Share Link | Ends visitor access through that Share Link, including existing visitor sessions. |
API keys have their own expiration and can be revoked individually, allowing one integration to be stopped without interrupting others. A site-wide key belongs to the site, so disabling the administrator who created it does not revoke it. A user key depends on its associated user remaining enabled.
Changing a password does not replace those separate credential controls. An application holding a valid API key can authenticate again even if a previous login session was invalidated. Disabling the user stops access through that user's credentials; deleting the individual credential stops access through that credential.
SSO and Account Deactivation
Disabling an account at your identity provider prevents future authentication there. Automated provisioning or Files.com user administration must also deactivate the corresponding Files.com account to end its access. API keys and SSH keys do not contact the identity provider each time they are used.
Disabling an SSO integration in Files.com prevents new sign-ins through it and invalidates existing login sessions for users assigned to that provider. It does not delete those users or revoke their separately issued API and SSH keys.
Expiration and Shared Access
Reducing Desktop/Mobile Session Lifetime affects newly issued app credentials. Existing credentials retain their expiration, so reducing the setting does not immediately end current app access. Reconnecting with the same credential does not apply the new lifetime. The Active Desktop Connections controls revoke an existing Desktop connection.
Share Links have their own access controls and visitor sessions. Disabling a creator leaves their Share Links available by default. The automatic revocation setting connects Share Link revocation to the creator's account status. Enabling invitation access control on an existing link restricts new access; revoking the Share Link ends existing visitor access.
Downloads Already Authorized
Revocation applies when Files.com next checks the affected credential or session. A temporary download URL already issued for a Files.com-hosted file has its own expiration and can remain usable after the login session ends. Ending a session therefore does not guarantee that every previously authorized transfer stops immediately. Files already downloaded remain with their recipient.