How do approvals with a manager's PIN work?

Money actions like refunds can be approved at the venue with a manager's PIN instead of a password — including a special approval-only PIN for the owner.

When a money action needs an identity check on a shared front-of-house device, a staff member who's allowed to do that action can approve it by typing their own PIN — no password needed.

When the prompt appears. Actions that move a customer's money or value need a confirmation. That covers bookings (refunding a deposit, charging or refunding a no-show fee, cancelling a booking, refunding a payment-link payment), events (cancelling or refunding a ticket — including tickets on an event that's been cancelled — refunding some of an order's tickets, moving a guest to another table when money goes back, and cancelling a whole event with refunds), gift cards (refunding a purchase, voiding a card or correcting its balance, and resending a card's email — selling, activating and extending a card's expiry deliberately need no approval), Order & Pay (refunding a table order, whether rejecting it or refunding after the event) and loyalty (adjusting a member's balance). A PIN approval is also offered for bigger operational actions when the staff member holds that action's permission: messaging all of an event's attendees or your loyalty members, messaging a day's guests from Messages (10 or more), sending a marketing campaign to 10 or more people, replacing the whole menu with an import or undoing an import in its first 30 minutes, deleting images from the image library, and staff management (removing a staff member, changing someone's role, clearing all sign-in lockouts). Where a PIN approval is offered, a pop-up titled Approve this action opens instead of (or alongside) the password prompt.

• When the Approve this action pop-up appears, hand the device to (or call over) someone whose role allows that action — for example, refunds need the refund permission, which is off for Managers and Hosts unless you've granted it.
• The pop-up asks Who's approving? and lists only the people who can approve this action with a PIN. They tap their name, then type their PIN (when only one person can, their name is already chosen; Someone else goes back to the list).
• They click Approve (or the PIN submits itself when the last digit goes in).
• The pop-up shows "Approved — applying now…" while the action lands, then closes — and the Activity log records exactly who approved what, in words: "Sam Reid approved a deposit refund with their PIN".

A few rules keep this safe:

• A PIN can never approve more than its owner could do themselves. The PIN holder's own role, plan and overrides are re-checked at the moment of approval.
• The PIN is only ever checked against the name tapped. It's never matched against the whole team, so two people can have the same PIN without either finding out — and typing a PIN never reveals whose it is.
• One approval, one action. Each PIN approval covers a single action and expires within two minutes if unused.
• Wrong PINs lock the approval prompt, not the portal. Five wrong PINs within 30 minutes locks approvals for 30 minutes ("Too many attempts — try again shortly") — staff sign-in on the device is unaffected.
• Customer data never accepts a PIN. Customer data exports, erasure and other privacy tools always require the account password.
• If the signed-in user could confirm with a password instead, the pop-up offers Use your account password instead.

The owner's approval PIN. You sign in with a password, so you have no login PIN — but you can set an approval-only one. On the Staff page, open the … menu on your own row (or click your name) and choose Approval PIN, enter a New PIN and Confirm PIN, then Save PIN. As the pop-up notes, "This PIN can't be used to sign into the staff portal — it only approves or overrides restricted actions." Remove it any time with Remove PIN. Only Owners and Admins see Approval PIN. Whenever your approval PIN approves something while someone else is signed in, your notification bell says so ("Your approval PIN was used") — what it approved, on which device and who was signed in — and, while Money and security alerts on my devices is on, your own phone or computer gets it as a push too, so a PIN someone has seen over your shoulder can't be used quietly.

Related: How do I reset or change PINs? · What can each role do? · How do I cancel a booking (and what happens to the deposit)?