Signing in at the till with a PIN

At a busy counter, typing an email address and password is too slow, and staff end up sharing one signed-in session all day. A PIN fixes that: six digits, entered on the keypad, and the right person is signed in within a second.

A PIN is an identity, not a password

This is the part worth understanding before you set any up, because everything else follows from it. When someone taps a PIN at the till, they do not choose a name first. The register looks at everyone in your business who has a PIN and works out who was typing from the PIN alone.

Two consequences:

• No two people can share a PIN. The system refuses a duplicate when you set it. If two people could share one, the second person would never be able to sign in at all.
• A PIN identifies the person who rang the sale. Lending it to a colleague does not just bend a rule — it files their sales, refunds, discounts and drawer counts under your name.

Why every PIN is being rejected

If the till says Invalid PIN no matter what is typed, the usual cause is that nobody has a PIN set yet. A business whose staff were added without one has nothing for the register to match against, so every code is invalid — and the message cannot tell the difference between “wrong PIN” and “no PINs exist”. It is deliberately vague, because a message that distinguished the two would help someone guessing.

Set one PIN, try again, and you will know immediately which it was.

Giving someone a PIN

An administrator or manager sets PINs for staff:

1. Go to Team → Users.
2. Edit the person, or add them if they are new.
3. Enter a 6-digit PIN, or use Generate PIN to have one picked that is guaranteed not to clash with anyone else's.
4. Save, and tell them the number.

Staff can also set or change their own from My Profile, at the bottom of the sidebar. Changing an existing PIN there asks for the account password first, so someone who walks up to an unlocked screen cannot quietly replace it.

Where you can, let people set their own. A PIN nobody else has ever seen is the only kind that reliably proves who was at the register.

What makes a valid PIN

• Exactly six digits. Numbers only — it is typed on a keypad.
• Not an obvious one. Repeated digits, simple runs and repeating patterns are refused. A PIN that is guessed in three tries is not protecting the drawer.
• Unique in your business. If it is taken, you are asked for another. You are not told whose it is.

These rules apply when a PIN is set, never when it is typed at the till. An older PIN that predates the rules keeps working until someone changes it.

Signing in and swapping over

On the register's sign-in screen, tap the six digits. That is the whole flow.

Mid-shift handovers use the same PIN: choose to switch user and the next person enters theirs to take over the register. The previous cashier does not have to sign out first, and the open shift and its drawer stay exactly where they were — only the person attached to the sales changes.

Too many wrong attempts

Repeated wrong PINs lock PIN entry for a while. Two things to know about that:

• The lock applies to the whole shop, not one person. Because a PIN carries no name, there is nothing else to count against — and every till in one building usually shares a single internet connection. The allowance is raised to account for that, but a determined wrong-guesser will lock out their colleagues too.
• A successful sign-in does not clear the count. That is deliberate: if it did, a person guessing in the corner would have their counter reset every time a colleague legitimately signed in.

If it locks, sign in with email and password instead — that route is unaffected — and wait it out.

Forgotten, shared, or someone has left

A PIN cannot be looked up. It is stored scrambled, so nobody — including support — can read it back. The only options are to replace it or clear it.

• Forgotten: an administrator sets a new one from Team → Users, or the person sets their own from My Profile.
• Shared by accident: change it the same day. Until you do, that person's name is on everything rung with it.
• Someone has left: deactivating the user is what matters. An inactive account cannot sign in by PIN even though the PIN still exists on the record.

Deciding who gets one

A PIN only changes how somebody signs in — never what they can do. Permissions come from the person's role exactly as they do when they sign in with a password. Give PINs to everyone who works a register; there is no security gain in withholding one, and a shop without enough PINs is a shop sharing a session.