Permissions
Hyvä POS is in closed beta
Hyvä POS is currently in a closed beta (pilot phase) with a small group of merchants. It is not yet generally available: the App Store release follows the pilot, and features and configuration may still change, possibly in backwards-incompatible ways, before the general release. Want to take part? Sign up at hyva.io/pos.
The app only works with what your API user is allowed to see. During setup it tests the connection and checks each resource it needs, and lists the permissions that are missing. This page lists what the app checks and what happens when a resource is not available.
Resources the App Checks
| Magento ACL resource | What it enables in the app |
|---|---|
Magento_Sales::sales_order |
The Orders tab, order search, order management |
Magento_Sales::invoice |
Invoice data on orders, email receipts via invoice email |
Magento_Sales::creditmemo |
Refunds and exchanges (credit memo creation) |
Magento_Sales::shipment |
Shipment data, pickup completion |
Magento_Catalog::products |
The product catalog, search, scan-to-cart |
Magento_Catalog::categories |
Category browsing |
Magento_Customer::customer |
Customer search, creation, and management |
Magento_SalesRule::quote |
Cart price rules and coupon codes. The register reads the store's cart price rules to apply them at the counter, offline too, and looks a coupon code up when the cashier enters one. Without it the register logs an authorization error on the first rule read and sells without cart rules |
Magento_Tax::manage_tax |
Tax rates, rules and classes. The register reads them to price every line with the right tax, offline too |
Magento_Catalog::attributes_attributes |
Product attributes: the labels of the options a configurable product is sold by, and the attributes the register reads for a product's details |
Magento_InventoryApi::source |
Multi-Source Inventory stock levels and sources. Whether the register uses Multi-Source Inventory is a setting, not a runtime check: the connection test sets it once (row Inventory (Multi-Source)), and it can be changed under Settings → Store Configuration → POS Inventory → Use Multi-Source Inventory. On PRO it comes from Stores → Configuration → Hyvä POS → Terminal Defaults → Stock → Use Multi-Source Inventory, per location, and Lock Use Multi-Source Inventory keeps the device from changing it |
The connection test runs during guided setup and again whenever you re-test from settings. A missing permission does not block the connection: the app disables the affected area and keeps everything else working. A register without customer permission can still sell; it just cannot attach customers.
The same screen reports one row that is not a permission: Hyvä POS Module for PRO users. When the module is absent, the row reports it as not installed and the free version in use. That is not a fault: setup continues, and the register runs the free tier. When the module is present, the wizard gains its PRO steps.
A Dedicated Role for the POS
This is optional, since any account with the resources above works, but we recommend a dedicated Magento role for the POS integration instead of reusing a personal admin account:
- System → Permissions → User Roles → Add New Role.
- Under Role Resources, grant the resources from the table above.
- Attach the role to the integration (for token or OAuth authentication) or to a dedicated admin user (for admin login).
A dedicated role keeps the register's access as small as possible, and revoking it later does not affect anyone's admin account.
Placing orders
Orders are placed through the standard Magento sales API with the same resource (Magento_Sales::sales_order) used for reading orders. There is no separate "create order" resource to grant.