How to let staff take payments without handing over the business

Almost every small business starts with one login, because the alternative is that the owner stands at the counter for every hour the shop is open.

Then the shop grows, and the shared password quietly becomes the biggest unmanaged risk in the business.

What a shared login actually costs

You cannot tell who refunded the sale that does not add up. You cannot remove the cousin who worked two weekends in March. The settlement account — the one that says where all your money goes at the end of the day — can be changed by anyone who has ever seen the phone.

None of that is theoretical. The shared login is usually fine right up until the week it is extremely not.

Roles the software enforces

Everyone gets their own sign-in and a role. The role is not a policy on a wall; it is enforced on every request.

A cashier takes payments and refunds up to a limit you set. They are refused settlement instructions, API secrets, statements, customer exports and member management — not hidden from them, refused.

A finance manager changes settlement instructions and refunds above the cashier limit, and never sees API keys.

A developer manages keys and webhooks and cannot issue refunds.

Read-only sees and touches nothing.

The refund limit is the one that matters

Refunds are where a counter leaks. Set the cashier limit at whatever a genuine mistake looks like in your shop — a wrong quantity, a duplicate scan. Anything above that is refused and has to be done by someone with the authority.

It is worth being clear about what a refund can and cannot do: it returns money to the payer of the original payment. It is not a way to send money to an address of the cashier’s choosing. The limit and the destination together are what make the counter safe.

The owner cannot be removed

The owner role is immutable. Not by an administrator, not by another owner, not by anybody. This closes the oldest ugly scenario in shared-account businesses: a falling-out in which somebody with access locks everyone else out of the money.

Leavers are a click

Remove the person. It takes effect immediately. Their past actions stay in the audit trail under their own name, which is the point — you keep the history and lose the access.

No password to change, no scramble to work out what they could reach, because they never had yours.

Branches

Business units can be linked to locations, so a payment taken at a branch carries the unit it belongs to. Two shops, one account, and figures you can actually compare.

What it costs

Nothing per person. Invite as many people as the business needs.

What you can check

These are facts about the running platform, not adjectives. Each one is visible in the product, in the API reference or in the ledger.

• A cashier takes payments and refunds up to the organisation’s limit, and is refused settlement instructions, API secrets, statements, customer exports and member management.
• A finance manager changes settlement instructions and refunds above the cashier limit, but never sees API keys.
• A developer manages keys and webhooks and cannot issue refunds; the keys stay with the business when the developer leaves.
• The owner is immutable: the role cannot be removed by anybody, including an administrator.
• Business units can be linked to locations, so a payment taken at a branch carries the unit it belongs to.

What it costs

Included. There is no per-seat charge, and a business can invite as many people as it needs.

Is it switched on?

Whether this is available depends on the authorisations in place and on what the administrator of a given deployment has switched on. That changes, and an article does not — so the live answer lives on the feature page, which reads it from the platform itself: Team and roles on the features page.

Read next

• Point of sale — The till is the phone you already own.
• Connected accounts — Onboard your customers by API. Hand over when they are ready.