Signing in
Two ways in: email and password for people who administer the business, Tenant ID and PIN for the counter. Which one each person may use is set by an administrator. In the installed app, email-and-password users can also sign in with Face ID or a fingerprint once they have turned it on. PIN sign-in can also work with no connection on a device that has been set up for it.
The sign-in screen
One card with a switch between Email & password and PIN.
Email & password
- Enter your Email and Password and press Sign In.
- You land in your organisation. If you belong to more than one, you land in the first that allows password sign-in and can switch afterwards (see below).
Tenant ID + PIN
Built for a shared device. The first time on a device:
- Switch to PIN. Enter your organisation's Tenant ID (the short code your owner can read under Settings → Administration → Organisation). As you type, the screen confirms the organisation's name: "Signing in to Acme Supplies".
- Enter your 4 to 6 digit PIN and press Sign In.
The device remembers the organisation, even after signing out. From then on the PIN tab shows "Signing in to organisation" and staff type only their PIN. Change Tenant forgets the organisation (and the offline sign-in roster below) so a different Tenant ID can be entered. Because a PIN alone identifies you, PINs are unique within an organisation.
Face ID and fingerprint sign-in
In the installed app on a phone or tablet, anyone who signs in with an email and password can sign in with the device's own biometric check instead: Face ID or Touch ID on an iPhone, a fingerprint or face unlock on Android. The app calls it whatever the device calls it; this page says "Face ID" for short. It stands in for your password, so it opens the same session an email-and-password sign-in would, under the same session lifetime. It is not available for PIN-only accounts, in the web browser, or without a connection.
Turning it on
- After you sign in with your password on a device that has Face ID or a fingerprint reader set up, the app asks once: Sign In With Face ID? Press Turn On Face ID and pass the prompt. Not Now closes the question for good on that device; you can still turn it on later.
- Any time: Settings → My Settings → Security, the Sign-In card, Turn On Face ID. See Security (My Settings). The button needs a session that was opened with your email and password (not a PIN) and a connection.
What happens underneath: the server gives the device a sign-in key of its own and keeps only a fingerprint of it; the device locks the key in its secure storage behind the biometric check, so it cannot be read without passing that check. Your password is never stored on the device. A device holds one such key, for one person in one organisation.
Signing in with it
Open the app. On a device that is set up, the sign-in screen starts the Face ID prompt by itself as soon as it appears: pass it and you land in your organisation exactly as after a password sign-in. The Email & password tab also shows a Sign In With Face ID button, with the email it signs in under it; press it to try again if you cancelled the prompt, or if the app was not in front when the screen opened. The password form stays below, so you can always type your password instead.
The prompt does not start on its own right after you press Sign Out: Face ID answers to a glance, and someone who has just signed out should not be signed back in by looking at the phone. The button still works. Without a connection the prompt waits, and comes up once the connection is back.
If the device was set up by someone else, Not You? → Forget removes their Face ID sign-in from this device (and from nowhere else) so you can sign in and set up your own.
Turning it off, and when it turns itself off
- On this device: Settings → Security → Sign-In → Turn Off Face ID, or Not You? on the sign-in screen.
- On a device you no longer have: Settings → Security → Sign-In lists every device set up for your account in this organisation, with when it was added and last used. Remove stops that device signing in at once. Do this first if a phone is lost.
- A new password turns it off everywhere. When a new password is set for your account, every device's key stops working. Sign in once with the new password and turn Face ID on again.
- Ninety days unused retires a device's key. A phone in daily use never reaches this; a drawer phone does.
- Changing the biometrics on the device (adding a fingerprint, resetting Face ID) makes the device retire the key itself. The next attempt says so and asks for your password.
- Losing access — being deactivated, removed from the organisation, or switched to PIN-only — refuses the key the same way it refuses your password.
Signing out does not turn it off: that is the point. The next sign-in is one prompt away. Each biometric sign-in, and each time it is turned on or off, is written to the organisation's audit log.
Signing in offline
A device with no connection can still sign staff in by PIN, provided two things are true:
- The person is allowed. Their user record has Allow offline sign-in ticked (Users → the person → Sign-in). It is off by default, needs a PIN and a sign-in method that includes PIN, and an administrator with
Users.Editsets it. A PIN set before this feature existed becomes usable for offline sign-in after the person's next online PIN sign-in, or when the PIN is replaced. - The device has been set up. Anyone signs into the app on that device while online, by email and password or by PIN. That downloads the organisation's offline sign-in roster, and every online session refreshes it every few minutes, so a person given offline sign-in today can use it on any device that has been online since. The roster expires after 30 days without a connection. A device holds one roster: the organisation of the last session on it, which is also the organisation the PIN tab remembers. Someone who belongs to several organisations enrols the device for the one they land in or switch to.
With both in place, the PIN tab works exactly as usual when the connection is down: type the PIN, press Sign In. A yellow line on the sign-in card says whether the device is set up. Five wrong PINs in a row lock PIN sign-in on that device for fifteen minutes.
Messages you may see
| Message | Meaning |
|---|---|
| Invalid email or password | The email, password or PIN did not match. This is also what you see for a PIN that belongs to nobody. |
| This account signs in with a PIN for this organisation | Your method is PIN-only; use the PIN tab. |
| This account has been deactivated | Your account is switched off platform-wide. Contact your administrator. |
| This organisation has been deactivated. Contact its administrator. | The organisation itself is suspended. |
| Could not sign in. Check your connection. | The app could not reach the server, and this sign-in needs one: email & password, Face ID, or PIN in the web browser. |
| Offline — password and Face ID sign-in need a connection. | Both ways in on the Email & password tab need the server. The PIN tab may still work offline. |
| Face ID sign-in was reset because the biometrics on this device changed. Sign in with your password to turn it on again. | A fingerprint or face was added or removed on the device, so the device retired the key. Sign in with your password; the app offers to set Face ID up again. |
| Face ID sign-in is no longer valid on this device. Sign in with your password to turn it on again. | The server no longer accepts this device's key: it was removed under Settings → Security, a new password was set for you, or it went unused for 90 days. |
| Face ID is locked after too many attempts. Sign in with your password for now. | The device's own biometric lockout. It clears on its own, or when you unlock the device with its passcode. |
| Could not use Face ID. Sign in with your password. | The prompt failed for another reason (for example, the app was not in the foreground). Try again or use your password. |
| Your access to this organisation has been deactivated | Your membership of this organisation is deactivated; a Face ID sign-in is refused like a password would be. |
| Offline — this device has not been set up for offline sign-in. | Nobody has signed in here while online, so the device holds no roster. |
| That PIN did not match anyone set up for offline sign-in on this device. | Wrong PIN, or your record does not have Allow offline sign-in ticked (or had it ticked after the device last connected). |
| Offline sign-in has expired on this device. | The device has not connected for 30 days. Connect once and sign in again. |
| Too many failed attempts. Try again in N minutes. | Five wrong PINs in a row while offline. Wait it out. |
| You are back online. Sign in again to continue. | Rare: the device could not keep what it needed to complete your offline session. Sign in again and your queued receipts are sent. |
| Your offline session could not be continued: your PIN or access has changed. | When the connection returned the server refused the PIN you signed in with offline. Ask an administrator. |
| You were signed out after N minutes of inactivity, as your organisation's policy sets. | Nothing was touched for that long. Sign in again; anything waiting to sync is kept. |
| Your session ended after N hours, as your organisation's policy sets. | The fixed period your organisation allows a session has passed. Sign in again. |
| Your session has reached its time limit. Sign in again. | The same, noticed by the server when the app asked to refresh. |
| Update Required — This version of the app is no longer supported. | The installed app is older than the server still works with. The screen shows the version you have and the one required, and Open Store. Install the new version from there; if the requirement is lifted on the server instead, closing and reopening the app is enough. Any offline data waiting to sync stays on the device and is sent once you sign in on the new version. |
Repeated failed attempts from one network are slowed down; wait a minute and try again.
Staying signed in
Your session refreshes itself quietly. How long it lasts is your organisation's decision, set under Security for each combination of where you signed in (the web or the installed app) and how (email & password — which a Face ID sign-in counts as — or PIN): either a fixed period from sign-in, or a window of inactivity that every touch moves forward. Unless your organisation has changed it, a session lasts up to 30 days of use. When it runs out you are returned to the sign-in screen with a message saying why. If a session cannot be refreshed for another reason (after being deactivated or removed, for example) you are returned to the sign-in screen without one. Role changes reach you at your next sign-in or refresh, within about 15 minutes.
Switching organisations
If you belong to several organisations the account menu (the chip at the bottom of the navigation) offers Switch Organisation, listing each with a tick on the current one. Switching re-signs you into the chosen organisation. If you were on a screen the new organisation cannot show (a module it does not license, or a specific record) you are taken to the dashboard.
Signing out
Account menu → Sign Out. Your session ends on the server, and everything the app had cached is cleared so the next person on the device starts clean. The remembered Tenant ID for PIN sign-in is kept on purpose, and so is Face ID sign-in: the next person sees Sign In With Face ID with your email under it, and Not You? if they are not you. If receipts or prints are still waiting to sync, the app asks first and explains that they stay on the device until you next sign in here online.
Sign-ins (with whether they were biometric), failed sign-in attempts (the email or Tenant ID, the device and its address — never the password, PIN or key) and sign-outs are recorded in the organisation's audit log.