> ## Documentation Index
> Fetch the complete documentation index at: https://docs.filexpress.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Account security

> Two-step verification, active sessions and what happens to your access when your role or password changes

From **Security** (in the side menu) you can protect your account and see which devices have it open.

## Two-step verification (2FA)

With two-step verification, besides your password the system asks for a 6-digit code generated by an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, Authy, 1Password, etc.).

> [!NOTE]
>
> It is **optional**: each user decides whether to turn it on.

### Turn it on

**1. Go to Security**

Open **Security** from the side menu and type your current password in the activation box.

**2. Scan the QR code**

Scan the QR with your authenticator app. If you cannot scan it, type the key shown below the QR by hand.

**3. Confirm with a code**

Type the 6-digit code shown by the app and click **Activate**.

**4. Save your recovery codes**

The system shows **10 recovery codes**. They are shown **only once**: copy them and keep them somewhere safe.

Turning it on closes your other open sessions.

### Signing in with 2FA

After typing your email and password, the system asks for the 6-digit code from your app. If you do not have your phone, use **a recovery code**.

* Each app code works **only once**.
* After several wrong codes in a row, the sign-in attempt is cancelled and you must type your password again.
* Each recovery code works **only once**. When they run out, generate new ones from Security.

### Generate new recovery codes

In **Security → Regenerate codes** type your password and a current code from the app. The previous codes stop working.

### Turn it off

In **Security → Disable** type your password and a current code.

### I lost my phone and my codes

Ask an administrator of your company to **reset your 2FA** (in **Users**, the two-step verification icon). Your sessions are closed and you can set it up again when you sign in.

## Active sessions

In **Security → Active sessions** you see each device that is signed in: browser or app, system, IP, last use and start date. The session you are looking from is marked **This session**.

* **Close** — ends that session; the device will have to sign in again.
* **Close all other sessions** — leaves only the current one open. Use it if you lost a device or suspect someone else got in.

Sessions started before the version that added this list appear as *Unknown device* with no IP.

## When your sessions are closed automatically

The system closes **all** of a user's sessions when:

| Event | What is closed |
| - | - |
| An administrator changes your role, status or password | All your sessions |
| An administrator disables you | All your sessions |
| An administrator sends you a temporary password | All your sessions |
| An administrator resets your 2FA | All your sessions |
| You change your own password | All **except the current one** |
| You turn on 2FA | All **except the current one** |

## How long a session lasts

* **Browser** — the session stays open even if you close the tab and is **renewed automatically while you use it**. After **48 hours without activity** it is closed, and in any case it lasts **at most 7 days** from when you signed in; after that you must sign in again (and type the 2FA code if you use it).
* **Mobile app** — it renews automatically in the background. It is closed after **30 days without opening the app** and lasts **at most 90 days**; after that you must sign in again.

If your session expires, the system lets you know and takes you to the sign-in screen.

> [!NOTE]
>
> Each time it renews, the system replaces the session's credentials with new ones. If someone tried to reuse credentials that were already replaced, the whole session is closed for security.

## Disabled accounts and activation

* A disabled account **cannot sign in**, even with the correct password.
* When you sign up, the account stays disabled until the email is confirmed with an **activation code** sent by email. The code **expires after 30 minutes**, works once and is voided after **5 wrong attempts**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.