Account login proves who may access a workspace. Device keys determine who can decrypt it. The hosted service stores public device identities and wrapped workspace keys, but never the plaintext workspace key or recovery secret.
The normal path: approve from a trusted machine
Run docmancer cloud connect on the new machine. It registers as pending and displays a four-word pairing code. Run the same command on an already connected machine, compare the code, and approve.
The connected machine wraps the workspace key specifically for the new device. After approval, run docmancer cloud connect again on the new machine. It receives its wrapped key and starts sync automatically.
The four words are a readable representation of the cryptographic fingerprint. Full device IDs and fingerprints remain under advanced details for auditing.
The fallback: use the recovery kit
The first device creates and self-tests a version 2 recovery kit automatically. Save the one-time copy offline. The service stores only a recovery-wrapped workspace key and a public verification key.
If every trusted machine is unavailable, connect the replacement with:
docmancer cloud connect --recover
The replacement derives the workspace key locally and signs an approval bound to its exact device keys, workspace, current key version, and a five-minute expiry. The server verifies that signature and approves only that pending device. Replaying it after approval or using it for another device does not work.
There is no separate verify command in the normal journey because creation already proves that the kit can unwrap the current workspace key.
Version 1 recovery keys are decrypt-only. If your account reports that older protection, create a replacement version 2 kit from a connected device.
Revoke a device
Revoke a missing or compromised device from the account or local settings. Revocation blocks future sync but cannot erase keys or plaintext already held by that machine.
Before revoking your final connected device, either connect a replacement or confirm that you still hold a version 2 recovery kit. Support cannot recreate keys or bypass this boundary.