Permissions
Hyvä POS is in closed beta
Hyvä POS is currently in a closed beta (pilot phase) with a small group of merchants. It is not yet generally available: the App Store release follows the pilot, and features and configuration may still change - possibly in backwards-incompatible ways - before the general release. Want to take part? Sign up at hyva.io/pos.
The app only works with what your API user is allowed to see. During setup it tests the connection and checks each resource it needs, so you see immediately which permissions are missing. This page lists what the app checks and what happens when a resource is not available.
Resources the App Checks
| Magento ACL resource | What it enables in the app |
|---|---|
Magento_Sales::sales_order |
The Orders tab, order search, order management |
Magento_Sales::invoice |
Invoice data on orders, email receipts via invoice email |
Magento_Sales::creditmemo |
Refunds and exchanges (credit memo creation) |
Magento_Sales::shipment |
Shipment data, pickup completion |
Magento_Catalog::products |
The product catalog, search, scan-to-cart |
Magento_Catalog::categories |
Category browsing |
Magento_Customer::customer |
Customer search, creation, and management |
Magento_InventoryApi::source |
Multi-Source Inventory stock levels. Not part of the connection test: the app detects MSI at runtime and falls back to single-source mode when the resource is missing |
The connection test runs during guided setup and again whenever you re-test from settings. A missing permission does not block the connection: the app disables the affected area and keeps everything else working. A register without customer permission can still sell; it just cannot attach customers.
The same screen reports one row that is not a permission: Hyvä POS Module for PRO users. When the module is absent it reads Not installed - using free version. That is a statement of tier rather than a fault, setup continues, and the register runs the free tier. When the module is present, the wizard gains its PRO steps.
A Dedicated Role for the POS
This is optional - any account with the resources above works - but we recommend a dedicated Magento role for the POS integration instead of reusing a personal admin account:
- System → Permissions → User Roles → Add New Role.
- Under Role Resources, grant the resources from the table above.
- Attach the role to the integration (for token or OAuth authentication) or to a dedicated admin user (for admin login).
A dedicated role keeps the register's access as small as possible, and revoking it later does not affect anyone's admin account.
Placing orders
Orders are placed through the standard Magento sales API with the same resource (Magento_Sales::sales_order) used for reading orders. There is no separate "create order" resource to grant.