Staff accounts
Who can sign in to your shop's admin, and exactly what each of them can do. You are the owner — that account always has full access and can't be locked out.
What a person can do is the boxes ticked under their name, and nothing else. A role is a name and a starting set of ticks: picking it fills the boxes in for you, and you can then tick or untick any of them. Nothing is granted anywhere you can't see.
Adding someone
| Field | What to put in it |
|---|---|
| Name | Their name — it's what appears against the till sessions and stock moves they make, so use something you'll recognise on a report. |
| What they sign in with. Must be their own; two people sharing a login makes every audit trail useless. | |
| Password | At least 10 characters. Set one now and have them change it. |
| Role | A name for what they do — see Roles. Choosing one ticks that role's boxes under What they can do. Start with the closest fit and adjust the boxes. |
| Till PIN | Only on plans with tills. Optional, and worth setting for anyone who serves. It's the short code they punch in at the till to identify themselves on a sale, rather than typing an email and password at a busy counter. |
| Active | Untick to suspend someone without deleting them — a seasonal helper, someone on leave. Their history stays intact and they simply can't sign in. |
What they can do
Every permission is a checkbox, grouped by the part of the shop it covers. What is ticked is what they have — the role does not add anything on top. So "Cashier, but this one can also do refunds" is: pick Cashier, then tick Refund & void orders (returns). Changing their role later ticks that role's boxes afresh, so check the boxes before you save.
A box you can't tick is a permission you don't hold yourself: nobody can hand out access they haven't got. For an owner every box is ticked and locked, because an owner can do everything.
Managing existing staff
Each person is a row you expand. Inside you can change their name, email, role, till PIN and active flag, tick or untick what they can do, reset their password, or remove them. The box above the staff list filters it by name, email or role.
Passkeys
Staff can add a passkey to sign in with their face, fingerprint or phone. If someone has any, their row has a Remove passkeys button showing how many. Press it if they lose the device or you think someone else could use it. Resetting their password does not stop a passkey working, so do both when you need them locked out.
Till badge
On plans with tills, anyone who can operate a till gets two extra buttons. Till badge opens a printable card with a QR code: scanned at a till, it takes that till over in this person's name, so a sale is put against them without an email, a password or even a PIN. Keep it out of a customer's sight for exactly that reason. New badge issues a fresh code and the old one stops working straight away — that is what to press if a badge is lost.
- You can't remove your own account — that's the guard against locking yourself out.
- Only the owner can hand out the owner role.
- Prefer unticking Active to removing. Someone who leaves and comes back keeps their history, and their past till sessions stay attributed either way.
When a change actually bites
Two of these behave differently from each other, and the difference matters on the day somebody leaves:
| What you change | What happens to them right now |
|---|---|
| Their ticked boxes | Immediately. They don't have to sign out and back in — the next screen they open is judged by what is ticked now. Move someone from Content editor to Cashier and the page editor is refused on their very next click, while the orders list opens. |
| Their password | Not immediately. The old password is dead at the login screen, but a session they already have open stays open. Resetting a password is how you stop somebody signing in again; it is not how you throw them out of a session they are sitting in. |
| Untick Active, or Remove | Stops them signing in from then on. If you need somebody out of the building and out of the admin in the same minute, do this and make sure they are actually signed out. |