Self-Checkout
Hyvä POS is in closed beta
Hyvä POS is currently in a closed beta (pilot phase) with a small group of merchants. It is not yet generally available: the App Store release follows the pilot, and features and configuration may still change - possibly in backwards-incompatible ways - before the general release. Want to take part? Sign up at hyva.io/pos.
Kiosk mode turns a device into a customer-facing register: customers scan their own items and pay, no cashier in the loop. It is currently experimental: enable it per device under Settings → Advanced before the kiosk settings appear.
What the Kiosk Locks Down
In kiosk mode the register swaps its whole interface for a locked customer-facing shell. What customers can do is narrow by default - scan products, pick options, pay by card, choose a receipt - and everything beyond that is a toggle you opt into:
- Allow coupon codes - shows a "Have a coupon?" entry.
- Allow customer sign-in - account attach for store credit and loyalty points (below).
- Allow customer to decrease quantity - without it, quantities only go up; mis-scans wait for staff.
- Allow customer to cancel session - a cancel button that clears the cart, with confirmation.
All four are off by default. Anything that needs judgement - discounts, price overrides, refunds, negative-stock decisions - simply does not exist in the kiosk interface; it stays with staff on a staffed register.
Payment is card-only at the attached terminal, regardless of which tenders the staffed register offers: an unattended device does not handle cash. The receipt auto-prints on every kiosk sale (also enforced, so a customer cannot walk off without their receipt), with an optional email offer and the QR receipt page on top.
The Flow the Customer Walks Through
- The idle screen invites them to scan an item or tap start; language flags (below) sit in the corner.
- Scanning builds the cart on screen: product, options, running total. Scanning works with the same hardware as a staffed register - a fixed Bluetooth or USB scanner is the usual kiosk setup - or the device camera.
- Pay by Card hands over to the terminal: "follow the prompts on the card reader", with retry on failure.
- The done screen prints the receipt, offers email if enabled, shows the receipt QR, and returns to idle.
An abandoned cart cleans itself up: after the configured idle timeout (30 seconds to 5 minutes, default 90 seconds) with no interaction, the cart resets and the kiosk returns to the idle screen ready for the next customer.
Customer Sign-In with a One-Time Code
With sign-in enabled, a customer can attach their account to earn points or spend store credit - without typing a password on a shared screen. They enter their email, receive a short code, and type (or scan) it from the email. On success their name appears, credit and points balances show, and balances apply with one tap.
The codes are engineered against abuse, and every parameter is yours to tune in Stores → Configuration → Hyvä POS → Advanced → Self-Checkout:
| Setting | Default |
|---|---|
| OTP Length | 6 digits |
| Code TTL (seconds) | 180 |
| Max Verify Attempts | 5 |
| Resend Cooldown (seconds) | 30 |
| Per-Email Rate Limit (per hour) | 5 |
| Per-Terminal Rate Limit (per hour) | 20 |
Two properties matter beyond the numbers: the kiosk's response is identical whether an email has an account or not, so the screen cannot be used to probe which of your customers exist; and only a hash of the code is ever stored - there is no code to steal from the database. Expired codes are purged by a scheduled job.
Configuring the Kiosk
Everything else is per device, under Settings → Self-Checkout on the register:
- Exit PIN - required before the kiosk can start; this is what gets staff back out.
- Idle timeout - 30 seconds to 5 minutes, or disabled.
- Languages - which languages customers may pick on the idle screen (English, Dutch, German and French) and which one the kiosk starts in. A customer's language choice lasts for their session and reverts on the next idle screen, so the kiosk can happily serve a different language than the staff side runs in.
- The permission toggles and the email-receipt offer described above.
The kiosk PIN protects the app, not the device: without a device-level lock, the home gesture walks straight past it into Safari, Photos and iOS Settings. Locking the iPad is not optional for a kiosk - see locking the iPad for the Guided Access steps and, for an unattended kiosk, the MDM Single App Mode setup that survives a restart. The app reminds you of this in the kiosk settings.
Entering and Leaving Kiosk Mode
Staff start the kiosk from Settings → Self-Checkout → Enter Self-Checkout Now; the app spells out what is about to happen before switching. To leave, long-press the bottom-left corner of the screen (an invisible target, held for a moment), then enter the exit PIN on the keypad. A wrong PIN stays on screen and can be retried; there is no way out without it. Exiting ends the staff session and returns to the login screen, so an unlocked register is never one gesture away from a customer.
The Sale It Produces
A kiosk sale is a normal sale: a local receipt on the device, a Magento order, receipt sync, the same audit trail as a staffed register. It is stamped with the terminal it happened on and carries no cashier name - which is exactly how you slice kiosk revenue out in reports: by terminal.
Offline
The kiosk needs a connection. Its only tender is the card terminal, and account sign-in is a live exchange with Magento - so run kiosks where the network is reliable. A brief Magento outage behaves like on any register (the finished sale queues and syncs); without internet at all, the kiosk cannot take payment, and a staffed register with a cash drawer is the fallback.