Magento Configuration
Hyvä POS is in closed beta
Hyvä POS is currently in a closed beta (pilot phase) with a small group of merchants. It is not yet generally available: the App Store release follows the pilot, and features and configuration may still change - possibly in backwards-incompatible ways - before the general release. Want to take part? Sign up at hyva.io/pos.
The free app talks to Magento through the standard REST API. Nothing needs to be installed, but depending on the authentication method you choose there are one or two settings to prepare in the Magento admin.
Choose an Authentication Method First
| Method | Good for | Expires | Preparation needed |
|---|---|---|---|
| Integration token | Production registers | Never (until revoked) | Create an integration, enable one security setting |
| OAuth 1.0a | Production, strictest security | Never | Create an integration, copy all four keys |
| Admin login | Trying things out | 4 hours (auto-refreshed) | None |
For a register that runs all day, use an integration token or OAuth. Admin login is the fastest way to connect, but the token expires every few hours and the app has to renew it; that is fine for evaluation, less so for a busy counter. See Connecting your store for how each method behaves in the app.
Create an Integration
- In the Magento admin, go to System → Extensions → Integrations and choose Add New Integration.
- Give it a recognisable name, for example
Hyvä POS. - On the API tab, grant the resources listed on the permissions page (or start with All and restrict later).
- Save and choose Activate. Magento shows four credentials: consumer key, consumer secret, access token, and access token secret.
For integration token authentication you only need the access token. For OAuth you need all four values.
Allow Integration Tokens as Bearer Tokens
Since Magento 2.4.4, access tokens are not accepted as standalone Bearer tokens by default. For the integration-token method, enable:
Stores → Configuration → Services → OAuth → Consumer Settings → Allow OAuth Access Tokens to be used as standalone Bearer tokens → Yes
Without this setting, every request from the app is rejected with a 401 even though the token is correct. OAuth authentication does not need this setting, because the app signs every request instead.
Admin Token Lifetime
If you use the admin-login method, the token Magento issues expires after four hours by default:
Stores → Configuration → Services → OAuth → Access Token Expiration → Admin Token Lifetime (hours)
The app renews the token automatically when it expires (see connection troubleshooting), so you rarely need to change this. Do not set it to a very large value to avoid the renewal; a short-lived token is the safer default.
HTTPS
The app requires HTTPS with a valid certificate. iOS enforces this at the system level (App Transport Security), so a store on plain HTTP or with a self-signed certificate will not connect.
Two-factor authentication
If your admin accounts use 2FA (the Magento default), the admin-login method cannot authenticate through the API. Use an integration token instead. Details on the troubleshooting page.