Skip to main content

App passwords

Applies to: directory 0.24 · Checked: 01.10.2026

A mail program such as Thunderbird, or a phone's calendar and contacts over CalDAV and CardDAV, often cannot sign in through the sign-in page. For it, a person creates an app password. Their own password stays with them and never goes into the program. It is the platform's only protocol sign-in for third-party programs: one door in directory, one scope per protocol.

Turning it on​

It is off by default. An administrator turns it on in the console, under Security → Sign-in requirements: the App passwords card, the Allow app passwords box. Turning it off takes effect at once: nobody can create one, and existing ones stop working.

How a person creates one​

The Security tab of the portal /me shows an App passwords card. The person names the program and ticks what the password may do:

  • reading mail (jmap) — access to the mailbox;
  • sending mail (smtp) — sending through the server;
  • calendars (CalDAV) (caldav) — calendars and invitations in the calendar service;
  • contacts (CardDAV) (carddav) — personal and team address books in the calendar service and the organisation's directory on the coordinator.

The scope webdav is reserved for drives and is not issued yet.

The password is shown once, in groups of four characters. The spaces need not be typed. The table shows when each password was created and last used. Revoke turns one password off; the others keep working.

Worth knowing​

  • The password is good only for the scopes ticked, and each is checked only by the service of its protocol: mail for jmap and smtp, the calendar for caldav and carddav, the coordinator for carddav. It does not sign in to the portal, the messenger or a console.
  • The device passwords the calendar service used to issue keep working beside app passwords until the coordinator's administrator moves the dav_auth switch to identity; from then on CalDAV and CardDAV accept only app passwords from people. So people create their passwords first and the switch comes after — see The calendar in Apple Calendar, Outlook and CalDAV.
  • Twenty passwords per person at most.
  • Wrong attempts count together with those of the person's own password. Past the threshold the account is locked for the time set in the credential policy.
  • A password works only while the account is active. A leaver or a disabled account cannot use it.
  • Every check, every creation and every revocation is in the security event log. In the portal's "Recent sign-ins" the person sees which service checked the password (mail, the calendar, the messenger).