Self-hosted does not mean unprotected
YAFFA keeps your financial data on a server you control. Two optional features, both managed from your user settings, help you protect it further and let you work with it outside the browser. Neither is enabled by default, and neither changes how YAFFA works until you turn it on.
Two-factor authentication - a second lock on your login
With two-factor authentication (2FA), a stolen password alone is no longer enough to open your YAFFA account. After entering your password you also enter a short code from an authenticator app on your phone.
Standard authenticator apps.
Scan a QR code once with any TOTP authenticator app. Nothing is sent to a third party - the codes are generated on your phone and checked by your own YAFFA instance.
Recovery codes for a lost phone.
When you turn 2FA on, YAFFA shows a set of one-time recovery codes. Keep them somewhere safe: each one works once if you cannot reach your authenticator app.
Changes need your password.
Turning 2FA off or generating a new set of recovery codes asks for your current password, so someone using your unlocked browser cannot quietly weaken your protection.
A way back if you lose everything.
If you lose both your phone and your recovery codes, the person who runs your instance can disable 2FA for your account with a single command on the server.
Personal API tokens - automate your own data
Want to add transactions from a script, pull numbers into a spreadsheet, or connect a home automation? Create a personal API token in your user settings and call YAFFA's API directly. You are accessing your own data, with the same per-user isolation as the web application.
Give each token only what it needs.
Every token can read your data. You can optionally add permission to write financial data, and, separately, to change account and security settings. A token without a permission is refused when it tries to use it.
Tokens expire, and you can revoke them any time.
Each token has an expiry date, capped at a maximum lifetime that whoever runs the instance can configure (365 days by default). The token value is shown only once when you create it.
Generated API documentation.
YAFFA can publish interactive documentation of its API on your own instance. Whoever runs the instance decides who can see it: nobody (the default outside development), logged-in users, or everyone.
Fair-use limits per user.
API requests are limited to 120 per minute for each user, so one runaway script cannot slow down everyone else on a shared instance.
Good to know
Two-factor authentication is not available in the hosted sandbox, which exists for trying YAFFA out. On your own instance you can enable it at any time. Step-by-step guides and the operator settings involved are in the documentation for two-factor authentication and API access.