Account authentication authorizes access to encrypted workspace material. A trusted device or verified recovery key authorizes decryption. Email login alone cannot recover an existing workspace.
Set up recovery first
Use docmancer cloud connect --base-url https://api.docmancer.dev --create-recovery on the first device. It displays high-entropy recovery material once. Store it offline. The service stores only a recovery-key-wrapped workspace key.
Add a device
Run docmancer cloud connect --base-url https://api.docmancer.dev on the new device. It registers signing and box public keys in a pending state. Approve the fingerprint from an existing trusted device or the browser dashboard. The approving client wraps the current workspace key for the new device. Use --recovery-key instead when enrolling through verified recovery material.
Revoke and rotate
Revoke a missing or compromised device immediately from the dashboard. Rotation increments the workspace key version and tracks completion for every remaining approved device. Old ciphertext stays attached to its key version so clients can retain the required historic keys until retention permits removal.
If every approved device and the verified recovery key are lost, existing ciphertext cannot be decrypted. Support cannot bypass this boundary.