Create an app password
- Sign in at
https://{host}/and open your account settings. - Choose the application type you are connecting — the scope must match what the application does: a mail client needs the mail scope, a file drive needs the files/WebDAV scope.
- Give the password a name you will recognise (which computer and which application), and create it. The password is shown once.
Put that password into the application's settings. Every connection page in this manual — Mail, Calendar, Contacts, Files — expects an app password in the password field.
Why an app password, and not your sign-in password
An app password can be revoked without touching anything else: if a laptop is lost, delete that laptop's app password and the applications on it lose access while your sign-in, your mail and your files stay untouched. Each app password is scoped — a mail-scoped password cannot read your files, and a files-scoped password cannot send mail. Creating one per application is the whole point.
The Ordner command line
Ordner has its own command-line client, ordner, that speaks all four areas
from the shell — reading and sending mail with attachments and drafts, calendar entries,
contacts, file upload and download, shares and quotas. It authenticates the same way: a
credential named once, stored in the platform's keychain (the Secret Service, KWallet,
the macOS keychain, the Windows Credential Manager), and every protocol command uses it.
The first steps with it are the same pattern as the desktop applications: create an app password for it in the web interface, then add the account:
ordner mail account add lab --url https://{host}/jmap/api --user you@your-domain
ordner credential password lab --password-stdin
The CLI's own documentation (ordner --help, and the command help on every
subcommand) covers the rest.
Security notes
- Your sign-in password never leaves the web interface — no desktop application ever sees it.
- An app password is scoped: it grants one area, not the account.
- Delete an app password the moment the device using it is gone. Everything else keeps working.
Next chapters
Administration and the rest of the manual: