# Configure Sync Backend

For how to choose a provider, see [[2.08-Choose-Sync-Backend]]. For where data and backups are stored, see [[3.06-User-Data]] and [[4.23-Managing-Your-Data]]. The sync form lives in the app under **Settings** → **Sync & Backup** tab → **Sync** section. The structure below matches the form in the codebase.

## Where to Configure

1. Open **Settings** (gear icon).
2. Open the **Sync & Backup** tab.
3. In the **Sync** section, enable **Enable syncing** and choose a **Sync provider** from the dropdown.

The rest of the form depends on the selected provider. Common options (sync interval, manual-only, encryption) are described after the per-provider sections.

---

## SuperSync (Beta)

- **Info:** The app shows a short note that SuperSync keeps your tasks in sync across devices in real time and that data is stored on the sync server. SuperSync is currently in Beta.
- **Get a token:** Click **Open Server & Get Token** to open the server login page in your browser. After logging in, copy your access token.
- **Access Token:** Paste the token into the **Access Token** field. Required for SuperSync.
- **Advanced:** Under **Advanced**, you can set a custom **Server URL** (leave as-is for the official server). Here you can also **Enable Encryption** for end-to-end encryption; the app shows warnings about password loss and server data being replaced.
- **Encryption:** If encryption is enabled, you can **Change Password** or **Disable Encryption** from the same form. These actions replace server data and require the same password on all devices (or re-upload with a new password).

SuperSync uses a fixed sync interval and does not show the **Sync interval** or **Only sync manually** options; those apply to file-based providers.

---

## Dropbox

- **Authentication:** When you select Dropbox, the app uses OAuth: you are taken to Dropbox to sign in and authorize the app. No Dropbox password is stored in the app; only tokens are kept.
- **Sync interval** and **Only sync manually** appear (see below). **Encryption** is available under **Advanced** for file-based providers; you set a client-side encryption key so data in Dropbox can be stored encrypted.

---

## OneDrive

Available on **desktop (Electron)** and **Android** only; not in the web app.

OneDrive sync requires your own **Microsoft Entra** (Azure AD) app registration — the app ships without a built-in OneDrive client ID, so the **Use my own app registration** option is always on. Create one at the [Microsoft Entra admin center](https://entra.microsoft.com) under **App registrations** → **New registration**, then configure it as a **public client**:

1. **Redirect URI:** Add a redirect URI under the **Mobile and desktop applications** platform (**Authentication** → **Add a platform** → **Mobile and desktop applications**):
   - **Desktop (Electron):** `superproductivity://oauth-callback/onedrive`
   - **Android / manual fallback:** `https://login.microsoftonline.com/common/oauth2/nativeclient`

   Do **not** register these under the **Web** or **Single-page application (SPA)** platforms — token redemption then fails with `HTTP 400` (e.g. `AADSTS9002327`).
2. **Allow public client flows:** In **Authentication**, set **Allow public client flows** to **Yes**. Super Productivity authenticates with PKCE and sends no client secret; if this is **No**, sign-in appears to succeed but the token step fails with `HTTP 400 Bad Request` (`AADSTS7000218: ... 'client_assertion' or 'client_secret'`).
3. **API permissions:** Under **API permissions**, add the Microsoft Graph **delegated** permissions `Files.ReadWrite.AppFolder` and `offline_access`.

Then in Super Productivity:

- **Application (Client) ID:** Required. The **Application (client) ID** from your app registration.
- **Tenant ID:** Use `common` for personal or multi-tenant sign-in, or your specific tenant ID.
- **Sync Folder Path:** Stored inside your OneDrive **App Folder** (e.g. `Super Productivity`), not at your OneDrive root.
- **Authenticate:** Sign in via the link the app provides. On desktop the redirect is captured automatically; on Android/manual you copy the authorization code back into the app.
- **Sync interval**, **Only sync manually**, and **Encryption** (under **Advanced**) apply, as for other file-based providers.

**Troubleshooting `HTTP 400 Bad Request` after sign-in looks successful:** This is the signature of a registration that is not a public client. Confirm **Allow public client flows** is **Yes** and the redirect URI is under **Mobile and desktop applications** (not Web/SPA). The app surfaces the underlying `AADSTSxxxxx` code in the error message to help pinpoint the cause.

---

## Nextcloud

- **Server URL:** Required. Example: `https://cloud.example.com` or `https://example.com/nextcloud`.
- **Username:** Required. This must be your Nextcloud **user ID** — **not** your email address or display name. To find it, open **Files** in Nextcloud, click the **settings gear in the bottom-left corner**, and copy the `<user-id>` from the **WebDAV** URL shown there (`.../remote.php/dav/files/<user-id>/`). Do not use the number in a folder's address bar — that is a folder ID, not your user ID. (Nextcloud accepts an email/login name for _authentication_, so a wrong value here often still passes the login but then fails with a **404** because the files path does not exist.)
- **Login name / email (optional):** Use this only when your Nextcloud login is an email address or another value that differs from **Username**. If left empty, the app uses **Username** for authentication.
- **App Password:** Required. Create this in Nextcloud under **Settings** → **Security** → **App passwords**.
- **Sync Folder Path:** Path relative to the account's WebDAV files root where sync files are stored (e.g. `/super-productivity` or `/`). This is not your server's internal filesystem path.
- **Sync interval** and **Only sync manually** apply. **Encryption** is available under **Advanced** for file-based providers.

---

## WebDAV (experimental)

- **Info:** The form shows that generic WebDAV sync is provided as-is without support. If you are using Nextcloud, use the **Nextcloud** sync option instead. In the browser, a **CORS** note may appear: you may need to allow the app to make CORS requests to your WebDAV server. Use at your own risk.
- **Base URL:** Required. Example: `https://webdav.example.com/remote.php/dav/files/yourUserName/` or the WebDAV base URL provided by your server.
- **Username** and **Password:** Required for WebDAV.
- **Sync Folder Path:** Path relative to the WebDAV server root where sync files are stored (e.g. `/super-productivity` or `/`). This is not your server’s internal filesystem path.
- **Sync interval** and **Only sync manually** apply. **Encryption** is available under **Advanced** for file-based providers.

---

## Local File (experimental)

Available on **desktop (Electron)** and **Android** only; not in the web app.

- **Info:** The form states that local file sync stores data in a folder on your device and that you should **not** use file-syncing tools (e.g. Syncthing, Resilio) to sync that folder between devices—they can cause conflicts. For multi-device sync it recommends WebDAV, Dropbox, or SuperSync.
- **Sync folder path:** Required. On desktop, use the **Sync folder path** button to open a folder picker and choose where the sync file is stored. On Android, use the same button to open the Storage Access Framework (SAF) and select the folder.
- **Sync interval** and **Only sync manually** apply. **Encryption** is available under **Advanced** for file-based providers.

---

## Common Options (Dropbox, OneDrive, Nextcloud, WebDAV, Local file)

- **Sync interval:** How often the app syncs automatically. Hidden for SuperSync and when “Only sync manually” is on.
- **Only sync manually (disable automatic sync):** When checked, sync runs only when you trigger it (e.g. via the sync button). Shown only for file-based providers (Dropbox, OneDrive, Nextcloud, WebDAV, Local file).

---

## Encryption

- **SuperSync:** Encryption is configured in the SuperSync block (Enable Encryption, Change Password, Disable Encryption). The server can store only encrypted data; you manage the password and must use the same password on all devices.
- **File-based (Dropbox, OneDrive, Nextcloud, WebDAV, Local file):** Under **Advanced**, you can **Enable** client-side encryption. You set an encryption key; the app encrypts data before sending it. The key is not sent to the provider. You must set the same key on every device before the next sync. If encryption is already enabled, the form shows that the password is set and offers **Change Password** or **Disable Encryption** (or **Remove Encryption**). Enabling or disabling encryption replaces data on the remote side (Dropbox file, Nextcloud/WebDAV folder, or local file) and affects all devices.

---

## Related

- [[1.02-Configure-Data-Synchronization]] — Quickstart: set up and configure sync from start to finish
- [[2.08-Choose-Sync-Backend]] — Which provider to choose
- [[3.08-Sync-Integration-Comparison]] — Provider comparison
- [[3.06-User-Data]] — Where data and backups are stored
- [[4.23-Managing-Your-Data]] — Backups, import/export, and sync from a user perspective
