Staff and Roles

On the free tier, the register has one user. PRO gives every employee their own PIN, with permissions that come from roles you manage in Magento, so the register records who performed each action and enforces what each person may do.

PIN Login

Staff members are created in the Magento admin (POS → Staff → Manage Staff) and assigned to locations and a role. On the register, each shift starts with a PIN: the sale, the drawer opening, the stock change all carry the person who did them, and reports show it. Every staff record also carries a staff ID (an employee code, generated when the record is created): choose it as the receipt's staff-name format and receipts stay anonymous for customers while the store can still trace every sale to a cashier; see receipt layout.

Whether the register requires a login is a Magento switch: Stores → Configuration → Hyvä POS → General → Require Staff Login.

What Magento Stores

A staff record is a name, an email, a staff ID, location assignments, a role, and a PIN. The PIN never exists in readable form on the server: Magento stores only a bcrypt hash, and that hash is never sent to devices: the API that ships staff lists to registers omits it. Each successful online login is recorded as a session in Magento, and every consequential action a staff member takes at the register lands in the audit log (POS → Audit Log) with their name on it.

Roles and the 50 Permissions

Roles are managed under POS → Staff → Roles. Every permission is an individual switch on the role, 50 of them, grouped as on the role form:

• Sales (10): place orders, apply discounts, apply coupons, custom line items, issue refunds, approve returns, void orders, price override, tax-exempt sales, reverse charge.
• Payments (5): accept cash, card, split payment, store credit, pay by invoice.
• Register (4): open register, close register, cash in/out, view register history.
• Customers (4): view, create, edit, assign customer group.
• Catalog (6): view products, view stock levels, manage stock, assign location to product, toggle ship-together, edit checkout dashboard.
• Reporting (3): view reports, view daily summary, export reports.
• Staff & Admin (4): view users, manage users, assign roles, view audit log.
• Settings (9): all settings: save, all settings: read, and one switch per part of the device's Settings (license and subscription, barcode scanner, printers, payment terminal, customer display, self-checkout, appearance and display).
• Hardware (3): open cash drawer, print receipts, print barcode labels.
• Held Transactions (2): hold cart, recall any cart.

Three roles ship as defaults:

Duplicate and adjust them, or build your own: every permission is set on the role, and the register enforces it per action.

The Security Details

• First login must be online; from then on the PIN verifies offline against a securely cached, salted slow hash (never the PIN itself), compared in constant time.
• PIN changes invalidate the cache everywhere. Each staff record carries a change watermark that is stamped in the same operation that stores the new PIN, so the two cannot drift apart. Registers receive the watermark with every staff sync; a mismatch drops the cached credential immediately and forces one online login with the new PIN. Changing a PIN in Magento is therefore an effective lockout within minutes, on every device at once, including devices that are offline when the change happens; they re-check at their next sync.
• Lockouts are graduated and per person: repeated wrong PINs lock that staff member out on a rising schedule (15 seconds after 3 failures, 1 minute after 5, 5 minutes after 8, 30 minutes after 12) without affecting colleagues. The failure counter resets after 24 hours. The lockout is enforced server-side and the app does not fall back to offline verification while locked, so offline mode cannot bypass it. An admin can unlock early from Magento.
• Inactivity locks the register after a configurable timeout (5 minutes by default); unlocking takes the PIN again.

Changes Reach Devices Fast

PIN changes, role changes and deactivations sync to the registers through the heartbeat, within minutes. Deactivating a staff member in Magento is how you off-board: their PIN stops working everywhere at once. There is nothing to clean up on the devices themselves; the registers read the staff list from Magento rather than keeping their own copy.

Offline

After the first online login, PIN verification works fully offline, so a network outage does not lock staff out mid-shift. Offline mode cannot bypass a server-side lockout or re-enable a changed PIN: both are checked against Magento when the connection returns, and a changed PIN stops working at the next staff sync.