Account authentication authorizes access to encrypted workspace material. A trusted device or verified recovery key authorizes decryption. Email login alone cannot recover an existing workspace.
Set up recovery first
Use docmancer cloud connect --base-url https://api.docmancer.dev --create-recovery on the first device. It displays high-entropy recovery material once. Store it offline. The service stores only a recovery-key-wrapped workspace key.
Add a device
Run docmancer cloud connect --base-url https://api.docmancer.dev on the new device. It registers signing and box public keys in a pending state. Approve the fingerprint from an existing trusted device or the browser dashboard. The approving client wraps the current workspace key for the new device. Use --recovery-key instead when enrolling through verified recovery material.
Revoke and rotate
Revoke a missing or compromised device immediately from the dashboard. The initial hosted product blocks key rotation until clients can submit a complete replacement wrapper set atomically, so revocation prevents future sync but cannot erase keys or plaintext already held by that device. Connect and approve a replacement before revoking the final approved device.
If every approved device and the verified recovery key are lost, existing ciphertext cannot be decrypted. Support cannot bypass this boundary.