Device logins (service accounts)
Create device logins for POS and kitchen screens, not staff email accounts.
A service account is a device login for hardware. Staff sign in with their own email; a register or kitchen screen signs in with a dedicated device credential. That split lets you give a device only the access it needs and cut it off without touching anyone's personal account.
Service accounts live under Settings → Organization → Service accounts. Your role needs access to view or manage device logins.
Understanding Device Identity Accounts
When you create a Service Account, GreenSails generates a secure, automated sign-in address for the device. This makes machine identities instantly distinguishable from human staff accounts in audit logs, member lists, and session records.
Because the address is non-deliverable, Service Accounts are pre-verified and never receive verification or marketing email. They exist purely to authenticate hardware.
Create the account
Give the account a recognizable name (for example,
"Front Counter Cluster" or "Kitchen Line, Store 12"). GreenSails issues the system email and a credential the device will use to connect.
Choose module access
Select which application modules the device is allowed to load (see below).
Scope to locations
Restrict the account to the specific locations whose data the device is permitted to read and write.
Provision hardware
Use the credential when setting up a terminal. Every terminal under this account inherits its module and location scope.
Enforcing Application Module Access
Module toggles restrict what a device can load when it initializes. A device only ever boots into the surfaces you have explicitly enabled:
- POS (Point-of-Sale): Full access to cashier screens, cash drawers, and receipt printing.
- Kitchen Display (KDS): Locks the device into the Kitchen Display ticket board app for cook-line fulfillment.
- Back Office: Restricts the terminal to administrative inventory counts and managerial shift audits.
Grant the narrowest set of modules a device actually needs. A kitchen screen should carry kitchen display access only (never POS) so a misplaced tablet can never be used to open a drawer or take payment. See Setting Up Kitchen Screens for the full KDS provisioning walkthrough.
Scope Restrictions: Assigned Locations
Assigned Locations define the security boundary of a Service Account. If an administrator restricts an account to specific locations, any device using that account is explicitly blocked from pulling inventory data or opening registers for any other store in the network.
This scoping is also what powers automatic hardware lockdown:
Orphaned Deactivation. If you remove a location from a Service Account's assigned list, every terminal that depended on that location is immediately disconnected and blocked. This is a safety feature, revoking a location's access instantly pulls clearance from all hardware that was relying on it. See Provisioning POS Terminals for the device-side behavior.