Desktop and Mobile App Sign-In

The Desktop and Mobile Apps use browser-based sign-in to apply your site's authentication requirements, including Single Sign-On and two-factor authentication. After you authenticate, the app receives a dedicated credential that keeps it connected with your permissions. Collecting and first using that credential are subject to checks separate from optional session IP pinning.

Pairing-Based Sign-In

The Mobile App and earlier Desktop App versions use a temporary pairing key to associate browser sign-in with a pending app connection. After authentication, the app can collect its credential only once, within 60 seconds of the credential's creation, and from the same public IP address as the browser. The time limit begins after authentication creates the credential, so it does not limit how long you have to complete SSO or two-factor authentication.

Desktop and Mobile credentials issued this way must also make their first connection from that same address within one minute of creation. Collecting the credential does not restart the clock. If its first connection is too late or comes from a different address, the credential is invalidated and a new sign-in is required. These conditions apply regardless of the connection protocol.

Desktop v6 Sign-In

Desktop v6 uses OAuth with Proof Key for Code Exchange (PKCE). Completing sign-in requires proof retained by the app that started it, and the browser returns authorization through a local connection on the user's computer. This allows the browser and app to use different outbound IP addresses, such as when they use different corporate proxies. The new app credential must still be used within one minute of creation.

Address Checks and Session Settings

The address Files.com observes can be shared by several devices behind a router, VPN, or proxy. Matching addresses do not establish that requests came from the same physical device. When comparing connections, two different devices on a shared network may still have the same public IP address.

Desktop Session IP Pinning adds an address restriction after sign-in. It is disabled by default so users can change networks without repeatedly signing in. Disabling it does not remove the initial sign-in checks described above. The Desktop/Mobile Session Lifetime separately determines how long an established app session remains valid.