Reset forgotten passwords from the login screen, turn on per-employee two-factor authentication, set switch-user PINs, restrict logins by time window and IP range, control session expiration, and connect enterprise SSO via SAML or OpenID Connect — with the audit trail recording who changed what.

Your point of sale holds prices, costs, customer records and the keys to the cash drawer, so its sign-in deserves the same care as your bank's. PHP Point Of Sale layers several protections onto employee logins; turn on the ones that match your risk.

Most per-person settings live on the employee record in Employees — alongside the basics covered in employee accounts — with the store-wide ones in Store Config.

Passwords, forced changes, and resets

Passwords are the baseline. Three things keep them healthy:

• Force password change upon login — a checkbox on the employee record. Tick it when you hand a new hire a temporary password: the first time they sign in they must set their own, and the temporary one dies.
• Self-service reset — on the login screen, click Reset password?, enter the username or email, and a reset link is emailed. The link is valid for 3 days; the new password must be at least 8 characters and entered twice. Outbound email must already be working — see email, SMS and notifications — or the reset mail never leaves.
• No back door — for security, support cannot look up or recover any password, including the admin's. A reset is always the path. If the admin account's email is unreachable, contact support with your store URL for a controlled recovery.

Two-factor authentication (2FA)

2FA requires a time-based code from an authenticator app (Google Authenticator or any TOTP app) on top of the password, so a stolen password alone no longer opens the account.

Turn it on store-wide, then each employee enrolls themselves:

1. In Store Config, open the Employee section and tick Allow employees to use 2FA (Two-factor Authentication), then Save.
2. Each employee opens their own profile — the Edit profile entry in the top-right user menu — and finds the Two Factor Authentication row.
3. Click Setup 2FA. A QR code appears; scan it with the authenticator app (or type the secret key in manually).
4. Enter the 6-digit code the app shows to verify, and 2FA is active. The profile now reads 2FA is active.

From then on, the login flow asks for the current code after the correct username and password.

Turning it off:

• The employee can click Disable 2FA on their profile — a current code from the app is required, so a bystander can't quietly switch it off.
• If the phone with the codes is lost, an admin can use Remove 2FA on the employee's account so they can sign in and enroll again — no locked-out accounts, no support ticket. Removing 2FA makes the account less secure, so do it only for a genuine lockout.

Switch-user PINs on shared registers

At the other end of the convenience scale, each employee can have a Switch User PIN of 4–6 digits — set on the employee record — used when clerks switch users on a shared register mid-shift, as a faster alternative to typing the full password.

Related settings:

• Enable fast user switching (password not required) (Store Config) — lets employees switch with no credential at all; the PIN matters when this is off or when an account opts out.
• Always require password when switching user — a per-employee checkbox that exempts that account from fast switching, forcing the full password every time.

The PIN is only for switching between already-signed-in sessions; the initial sign-in of the day always takes the password (plus the 2FA code, if enrolled). How switching works day-to-day is covered in employee accounts.

Restrict when and where staff can sign in

Two per-employee restrictions on the employee record narrow the window an account is usable at all:

• Allowed To Login Start Time / Allowed To Login End Time — the account only signs in between these times. Outside the window the login is refused with "You are not allowed to login at this time." A day-shift cashier has no reason to log in at 3 a.m.
• IP Addresses Employee Can Access From — enter one or more IP addresses or CIDR ranges (for example 203.0.113.7 or 192.168.1.0/24). With any entry present, the account works only from those addresses; from anywhere else it hits a block page that shows the offending IP. The account then works at the register but not from a home laptop. Local access (127.0.0.1) is not blocked, and an employee with no entries has no IP restriction.

Also remember: an employee can only sign into locations they are assigned to, and an account assigned to no locations cannot sign in at all — see locations and registers.

Sessions and HTTPS

A strong login means little if an abandoned session stays open all week. In Store Config → Application Settings:

• Session expiration — how long a signed-in session lives: On Browser Close (the default), 10 to 60 minutes in 5-minute steps, or 1 to 168 hours.
• Require https for program — forces every page, sign-in included, over an encrypted connection. Cloud stores already run on HTTPS.

The app also watches for session hijacking and cuts off a session that appears to have been taken over.

Single sign-on (SSO) for larger teams

If your organization already manages identities centrally (Okta, Entra ID/Azure AD, Google Workspace, Keycloak…), connect PHP Point Of Sale to it instead of maintaining a second set of passwords.

1. Go to Store Config and open the Single Sign On (SSO) Info section.
2. Choose the SSO Protocol: saml or oidc. The fields below change to match.
3. Fill in the protocol's fields (below), click Save, and an SSO Login button appears on the login screen.

SAML fields — copy these values from your identity provider:

• Identity Provider Entity ID (Metadata), Single Sign On Service URL, Single Log Out Service URL, and the provider's x509 Certificate.
• Saml Name ID Format — defaults to the email-address format when left blank.
• SAML Groups Field Name — the attribute carrying the user's groups; defaults to groups.
• SAML Locations Field — the attribute carrying location names; defaults to locations.
• First Name Field Name, Last Name Field Name, E-Mail Field Name — the attribute names for those values.

Your identity provider will ask for the service-provider details in return: the SP metadata is served at your store URL followed by /login/samlmetadata, and the assertion consumer service at /login/samlassertionconsumerservice?acs.

OIDC fields:

• OIDC Host — the provider's issuer URL.
• OIDC Client ID and OIDC Secret — from the app registration you create at the provider.
• OIDC Certificate URL — optional certificate for token verification.
• OIDC Additional Scopes — comma-separated extras; openid, profile and email are always requested.
• OIDC Username Field — the claim used as the username; defaults to email.
• OIDC Groups Field and OIDC Locations Field — the claims carrying groups and location names.

What happens on first SSO sign-in: an employee who doesn't exist yet is created automatically from the identity provider's data — name, email, username. Each group name sent is matched against your permission template names, and the first match becomes the new employee's template (see permissions and templates); each location name sent is matched against your location names and assigned. Name your groups after your templates and pass real location names, and new staff land ready to work.

Only Allow SSO Logins — the final checkbox turns off username/password sign-in entirely, so your identity provider becomes the single door in: disabling someone there disables them here. Confirm SSO works for your own account before ticking it.

Watch it all with the audit trail

Security settings prevent; the audit trail proves. Under Store Config → Audit Trail, tick Enable Audit Trail and choose the Audit Retention (days) — 30, 60, 90, 120, 365, or Forever. The app then records who viewed and changed what, and the Audit Trail report (permission-gated under Reports) is your security log when something looks off — it runs like any other report, per running reports. Pair it with tight permissions and you know both what each employee could do and what they actually did.

Common questions

I forgot the admin password — can support tell me what it is? No; nobody can recover a password, by design. Use Reset password? on the login screen. If the admin email is also unreachable, contact support with your store URL for a controlled recovery.

The reset email never arrives. Outbound email isn't configured or has broken. Fix it under Store Config → Email Settings and send a test email — see email, SMS and notifications. Also check spam.

An employee lost the phone with their authenticator app. An admin removes 2FA from the employee's account (Remove 2FA); the employee signs in with their password and enrolls again with a new device.

Why don't my employees see the 2FA option? Allow employees to use 2FA (Two-factor Authentication) is off. Enable it in Store Config → Employee; enrollment then appears on each employee's own profile.

Why is there no SSO Login button on the login page? The button appears only once the protocol is chosen and the key endpoint is saved — the Single Sign On Service URL for SAML, or the OIDC Host for OIDC.

A new SSO user signed in but has the wrong permissions. Their groups didn't match a permission template name. Rename the group at the identity provider or the template in PHP Point Of Sale so they match, or set the template on the employee record by hand.

Can I block password sign-in completely? Yes — tick Only Allow SSO Logins under Store Config → Single Sign On (SSO) Info. Test SSO with your own account first, because afterwards the identity provider is the only way in.

An employee gets "You are not allowed to login at this time." Their account has Allowed To Login Start/End Time set and it's outside the window. Adjust or clear the times on their employee record.

I restricted my own IP and locked myself out. Sign in from an address inside the allowed range (the block page shows the IP you came from), then edit the employee record and correct IP Addresses Employee Can Access From. If no allowed network is reachable, contact support.