Staff PIN and POS Devices
With staff PINs, several cashiers can take turns on one POS device (a tablet or POS phone) by picking their name and typing a 4 to 6 digit PIN, without typing their account password every time. Every sale is recorded under the person on duty.
Staff PINs arrive in the round 16 release and are available from the Growth plan. Password staff login keeps working exactly as before, so shops that do not use PINs see no change.
How it works: device first, PIN second
A 4 to 6 digit PIN is a weak secret. So a PIN is only accepted from a device an Owner or Admin enrolled. What the shop trusts is the device, not the PIN.
- An Owner or Admin, signed in with their own password (and 2FA), creates a device enrolment code.
- The POS device enters the code once and receives a device token, kept in the device's secure storage.
- From then on the device shows a PIN screen: a list of staff who have a PIN, then a keypad.
- A device has one PIN session at a time. A new PIN or the Lock button ends the previous session, so "who is at this till" is always clear.
The device token is not an account key. With it someone can only see the list of names and try PINs (rate limited). It cannot read data or sell anything without a staff PIN.
Enrolling a POS device
Open Staff > POS devices in the Dashboard (Owner or Admin).
- Choose Enrol a new till, enter a device name (for example "Till 1") and, if needed, a branch.
- The Dashboard shows a code like
K7QM-4XPDonce, with a countdown. The code is valid 15 minutes (adjustable 1 to 60), single use, and at most 10 unused codes can exist at a time. - On the POS device, choose Enrol this device and type the code.
A wrong, expired, or used code always gets the same answer ("invalid code"). Enrolment is limited to 10 attempts per 15 minutes per network.
The device list shows the label, branch, last seen, who enrolled it, the status (active, paused, revoked), and who is signed in. You can rename a device or change its branch. A device bound to a branch shows only staff of that branch (or with no branch).
Setting PINs
Open Staff > Staff PINs. Each row shows badges Has PIN, Locked, and last used.
| Action | Who | Notes |
|---|---|---|
| Set / reset PIN | Owner, Admin | Ends that person's PIN sessions. A PIN is never shown again |
| Remove PIN | Owner, Admin | Ends that person's PIN sessions |
| Unlock | Owner, Admin | Clears the 15 minute lock |
| My PIN | The staff member | Must enter their account password |
PIN rules:
- Length 4 to 6 digits (the minimum is a setting, up to 6). Digits only, no spaces.
- Unique within one shop: a PIN already used by someone else is refused, without saying who. Another shop may use the same one.
- Easy-to-guess PINs (
1234,0000) are refused. - Cashier and Kitchen may use a PIN. Admin only if you turn on Allow Admin PIN. The Owner never, because the owner is the shop account, not a till login.
- A PIN is stored only as a hash and is never logged or displayed.
PIN settings
| Setting | What it does |
|---|---|
| Minimum length | 4 to 6 |
| PIN-only sign-in | No name picking; the PIN alone identifies the person. Allowed only with 6-digit PINs (turning it on forces a minimum of 6) |
| Allow Admin PIN | Admins may have a PIN |
| Session length | 1 to 24 hours (default 12, one shift) |
The default is pick your name + PIN: a wrong guess is counted against that person. PIN-only is faster but a wrong guess cannot be blamed on anyone, so only the device is paused.
Switching staff at the till
- On the PIN screen, tap your name (a padlock icon means locked).
- Type your PIN. A wrong PIN shows the attempts left.
- You are in, and the previous staff session on that device ends automatically ("switch user").
A PIN session lasts one shift (default 12 hours) and is not renewed automatically: when it ends, type your PIN again. Every sale, refund, and shift open or close records who did it and whether by PIN or password, for example "Sold by Ani (PIN)". An Owner signing in through staff login is never recorded as staff.
Locking
The Lock button in the POS header ends the device's PIN session and returns to the PIN screen. It works even if the session already expired. Lock the till every time you walk away.
Attempt limits and lockouts
- Per staff member: 5 wrong PINs in a row lock that person for 15 minutes. A right PIN does not bypass the lock. An Owner or Admin can Unlock at once.
- Per device: 12 wrong PINs in a row (any staff) pause the device for 15 minutes.
- Per network and device: 30 PIN sign-in attempts per 15 minutes.
- A wrong PIN for a name that does not exist or has no PIN looks the same as any wrong PIN.
- Every PIN sign-in, lock, pause, PIN change, and device action is recorded in the Activity Log (never a PIN, code, or token).
Forgotten PIN, lost device
| Situation | What to do |
|---|---|
| Staff forgot their PIN | An Owner or Admin presses Reset PIN. The old PIN cannot be viewed. That person's PIN sessions end |
| Staff is locked | Wait 15 minutes, or an Owner or Admin presses Unlock |
| Staff leaves | Deactivate the staff member (PIN sessions end at once) or remove their PIN |
| Device lost or stolen | Revoke the device in POS devices. PIN sign-in from it stops and every PIN session it holds is ended (up to about 15 seconds on other servers). An attacker would still need a PIN |
| Enrolment code leaked | Cancel the unused code in the device list |
A PIN session is an ordinary token: someone who copies the token can use it elsewhere until it expires, is locked, or the device is revoked. Password staff logins are not session-tracked on the server, so only PIN sessions can be ended from the Dashboard.
Plans and roles
| Free | Growth | Pro | Enterprise | |
|---|---|---|---|---|
| POS devices, PINs, PIN sign-in | No | Yes | Yes | Yes |
Free has a single staff login, so there is nobody to switch to. A downgrade does not delete PINs, but PIN sign-in answers PLAN_LIMIT until the plan is raised. Owner and Admin manage devices and PINs. Cashier and Kitchen only manage their own PIN.
Security and MCP
Setting PINs, creating enrolment codes, enrolling or revoking devices, unlocking, and changing PIN settings are deliberately not available through MCP or the AI assistant. They create or neutralise sign-in credentials; only the Dashboard may do them. See Tool Surface.