Managed Sync Or Your Own Server

A synced graph needs a Sync Server, and there are two ways to have one. EtherPK Managed Sync is the service EtherPK runs, tied to an EtherPK Account and paid for by Sync+. Your own server is the same open-source software, run by you or your organisation, with its own accounts and no contact with EtherPK. The Client is the same either way, and neither server can read your notes.

	Managed Sync	Your own server
Address	sync.etherpk.com	Wherever you run it
Account	An EtherPK Account, signed in once for all three apps	A local account on that server
How the Client connects	Sign in; nothing to copy	Its address and a Personal Access Token
Cost	Sync+ for the graphs you own	Whatever it costs you to run
Limits	Set by the plan	Set by the operator, or none
Images and files	Included	Once the operator adds a storage bucket
Email verification and password reset	Yes	If the operator configures mail
Who may register	Anyone	The operator decides: open, closed or a list of addresses and IPs
Two-factor, passkeys, GitHub and Google sign-in	Yes	Two-factor and passkeys always; GitHub and Google if configured

Managed Sync

Sign in to your EtherPK Account and the Client follows. If the Client is not signed in, open Graphs > Sync settings, choose Managed Sync and select Continue to secure sign in. The Client signs in with your account and connects. Your plan and usage appear on the Knowledge graphs page, and the header shows your email with a menu that reaches Graphs, Account, Access tokens, Sign out of EtherPK and Disconnect this device.

The three apps keep separate sessions and never share a cookie; the Client asks for a short-lived token when sync needs one and never keeps it in storage. If your session expires, the Client asks you to sign in again and keeps local edits waiting. Changing your account's email address changes nothing about your graphs: the account is identified by an immutable id, and email and name are profile details.

Sign out of EtherPK in any of the three apps signs all three out. Disconnect this device in the Client ends only this device's sync connection and locks its keys, and stops the Client signing itself back in for the rest of the browser session; choosing Managed Sync again reconnects. Plans, billing and what happens when a subscription ends are in Your EtherPK Account.

Your own server

Open Graphs > Sync settings and choose Custom server.

1. Sign in to the server's portal in a browser, open Access tokens, and create a Personal Access Token named after this device. Choose an expiry, or none for a device you keep. The token is shown once.
2. Enter the server's address, https://sync.example.com, and the token, then select Save custom server. A server on your own machine can use http://.

The token proves your account to the server on every sync request and cannot decrypt anything. The header then shows the email the server confirmed, with a menu that reaches Graphs, the server's Account page and Access tokens, and Disconnect this device, which forgets the address and token on this device without revoking the token. To remove a device's access completely, disconnect it and revoke its token on the server.

The portal's own sign-in session and the Client's token are separate. Signing out of the portal does not disconnect the Client, and a token keeps working until it expires or you revoke it.

A Client deployed beside a server can come with the address filled in, and with Managed Sync absent altogether. One computer can be connected to only one server at a time in the browser; the Headless Client can be signed in to several (The Headless Client).

Registering on someone's server

Every server states who may register: anyone, nobody, or a list of email addresses and IP addresses, and a registration has to pass both lists. A refused visitor is told which rule refused them: a closed server shows no form, a wrong IP address shows a warning above the form, and an address not on the list is refused when the form is submitted, with what you typed kept. Existing accounts keep signing in whatever the lists say. If an expected GitHub or Google button is absent, the operator has not enabled that provider.

A server that cannot send email cannot verify addresses or reset passwords, and its invites resolve any registered address. Ask its operator how registration is restricted before trusting invites there.

Running a server is described in Self Hosting The Sync Server.

Moving between servers

A graph belongs to the server it was created on. To move one, keep a Local Mirror of it and import the folder as a new graph while connected to the other server (Keeping A Local Copy Of A Synced Graph, Importing From Logseq Obsidian Or EtherPK).