> For the complete documentation index, see [llms.txt](https://docs.resifactory.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.resifactory.net/imap/app-passwords.md).
# App passwords
An **app password** is a credential that works for IMAP and nothing else. It cannot sign in to the web console, it can be revoked on its own, and it carries its own settings — scope, inbox window, and an optional IP allowlist.
{% hint style="success" %}
**We recommend an app password for every IMAP connection, and an inbox window on every app password.** Those two habits prevent most of the problems people bring to support.
{% endhint %}
## The list
**App passwords** in the navigation.
| Column | What it tells you |
| ----------------- | ------------------------------------------------------------------------------------------- |
| **Label** | Your name for it. The green dot means active; grey means revoked. |
| **Scope** | `unified` (everything you own) or `batch` (one batch only). Batch rows also name the batch. |
| **IMAP username** | The username your client must send. `default` means the server's unified address. |
| **Inbox window** | How far back this credential can see. `–` means unlimited. |
| **CIDRs** | The IP allowlist, if any. `–` means any IP. |
| **Created** | When it was minted. |
| **Last used** | The last successful authentication. `–` means nothing has ever connected with it. |
### Filtering the list
The toolbar above the table:
* **Search** — matches the label or the IMAP username.
* **Status** — `Active` (default), `Revoked`, or `All statuses`.
* **Scope** — `All scopes`, `Unified`, or `Batch`.
* **Clear** — appears once any filter is off its default; resets everything.
{% hint style="info" %}
**`Last used` is your diagnostic.** If a client swears it is configured correctly but this column still reads `–`, the client has never successfully authenticated — the problem is the credential or the connection, not the mail.
{% endhint %}
## Creating one
Press **New**.
### Label
Required. Name it after the thing that will hold it — `refract-desktop`, `shikari-main`, `laptop`, `aug-drop-100 only`. When you later need to revoke one, the label is how you will know which.
### Scope
* **Unified: all your accounts and batches** — the default, and the right choice almost always. Sees every mailbox you own, including ones you buy later.
* **Batch: only one batch** — sees only the mailboxes in one batch. Picking this reveals a batch dropdown.
Full guidance: [Scopes](/imap/scopes.md).
### IMAP username
Pre-filled with your login email. This is what your client sends as the username.
You may change it to a different name — useful when you want a tool, a teammate or a project to connect under its own identity:
```
aug-drop@ops.yourdomain.com
```
{% hint style="info" %}
You **cannot** set it to another user's login email. The server rejects that.
{% endhint %}
Several app passwords may share the same username. The **password** decides which one you are using, and therefore which scope and window apply. That is what makes it practical to keep one username and several credentials with different windows.
### Inbox window
The dropdown offers nine choices:
**Set one.** Which one depends on what the tool does — the full decision guide is [The inbox window](/imap/inbox-window.md). Short version:
| Tool's job | Window |
| --------------------------- | ---------------------------- |
| Shikari | **Last 15 minutes** |
| Verification codes / OTP | Last 1 hour – Last 6 hours |
| Order and shipping tracking | Last 7 days – Last 14 days |
| Reading mail by hand | Last 1 month – Last 3 months |
A filled-in form, ready to create — a unified credential for Shikari with a 15-minute window:
### IP allowlist
Optional. A comma-separated list of CIDR ranges:
```
203.0.113.0/24, 198.51.100.7/32
```
When set, the credential only authenticates from inside those ranges. A single address is written as `/32` (IPv4) or `/128` (IPv6). Leave it blank for any IP.
{% hint style="warning" %}
Only use this if your IP is genuinely fixed. A residential connection that renews its address, a VPN, or a laptop that moves between networks will lock itself out — and the symptom looks exactly like a wrong password.
{% endhint %}
## Saving the password
The password is shown **once**, immediately after creation:
Copy it before you close the dialog. It is not stored anywhere you can read it back. If you lose it, revoke that password and create another.
## Managing an existing one
Right-click a row — or use the **⋯** button, or long-press on a phone:
| Action | What it does |
| ----------------------------- | ------------------------------------------------------- |
| **Copy ID** | The numeric id, useful when asking for help. |
| **Copy label** | The label text. |
| **Copy username** | The IMAP username — handy when configuring a client. |
| **Edit / Set IMAP username…** | Change the username this credential authenticates with. |
| **Edit / Set inbox window…** | Change the window. Takes effect immediately. |
| **Revoke** | Kill it. See below. |
### Changing the inbox window
Pick a new preset and save. The change applies to the **next command** your client sends — there is no need to restart the client or recreate the credential. Choosing **Unlimited** clears the window entirely.
{% hint style="info" %}
Narrowing a window makes older mail disappear from the client's view. Well-behaved clients handle that cleanly; a few will re-sync the folder. That is expected and harmless — nothing is deleted.
{% endhint %}
### Changing the IMAP username
Leave the field blank to fall back to the default. Existing connections that use the old username keep working until they reconnect, so change it at a moment when a brief reconnect is fine.
### Revoking
Revoking is **immediate and permanent**:
* Any IMAP session currently authenticated with that password is **disconnected at once** — not at the end of its session, not after a timeout.
* The password can never be used again and cannot be recovered.
* The row stays in the list, greyed out, so you keep the audit trail. Set the status filter to **Revoked** or **All statuses** to see revoked rows.
Revoke immediately if a credential has been shared, pasted somewhere public, or sat on a machine you no longer control.
## How many should you have?
One per tool, minimum. It costs nothing and it means:
* Revoking one tool's access never breaks another's.
* `Last used` tells you which tools are actually running.
* Each tool gets the window that suits it — a 15-minute window for Shikari and a 14-day window for order tracking, at the same time, on the same mailboxes.
A common set looks like:
| Label | Scope | Window |
| ------------------- | -------------------- | --------------- |
| `shikari-main` | unified | Last 15 minutes |
| `refract-desktop` | unified | Last 24 hours |
| `order-tracking` | unified | Last 14 days |
| `aug-drop-100 only` | batch → aug-drop-100 | Last 7 days |
## What app passwords do not do
* They do **not** sign in to the web console.
* They do **not** send mail.
* They are **not** the passwords for the individual mailboxes you bought. Those are separate, and you get them from [Accounts → export](/credentials/exporting.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.resifactory.net/imap/app-passwords.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.