Why We Built an Invite System for Adding Team Members

The Password Problem Nobody Talks About

Ask a cafe owner how their staff log in to the POS and you get the same answer almost every time: everyone uses the same password. Maybe it is written on a piece of paper taped under the counter. Maybe it is simply known by everyone who has ever worked a shift. Either way, it is the worst possible security setup — and it survives because nobody has offered an alternative that is both better and easy.

When we designed CrescendPOS, we wanted to kill that paper. That is why adding team members works through an invite system instead of the owner typing passwords for people.

How Adding a Cashier Usually Goes

The old way looks like this. A new cashier starts tomorrow. The owner opens the system, creates an account, types in a password, and tells the cashier what it is. The cashier forgets it, so it gets written down. The next cashier is shown the same paper. Six months later, three former staff members still know the password, and the owner has no idea who logged in when — or who voided that order at 9 p.m.

Every step in that process is a small surrender: a password that is shared, a login that cannot be traced to a person, and a system that cannot tell you anything about who did what. In an industry with high staff turnover, that is not a minor inconvenience. It is a leak — of accountability, and sometimes of money.

Why We Built Invites Instead

With the invite system, adding someone looks completely different. The owner opens the team page, enters the new person's email address — or just their name for a cashier account — picks a role, and sends an invite. The cashier receives a link, opens it, and sets their own PIN. The owner never sees or types a password, and never has to remember one on anyone's behalf.

Roles are part of the invite by design. A cashier role can take orders and make sales. A manager role can also view reports, handle refunds, and manage the team. The role travels with the invite, so there is no separate, easy-to-forget step of "also remember to restrict their access later."

The invite also solves a smaller but very real problem: new staff being added at the last minute. F&B hires rarely happen on a schedule. A cashier quits on Friday night, a replacement is found on Monday morning, and the system needs to be ready before the first order. With invites, the owner can complete the whole setup from a phone between meetings — there is no need to sit at the counter machine and configure an account while customers are already lining up.

PIN-Based Login With No Email Required

Here is the part that matters most for Indonesian F&B: cashiers rarely have company email accounts, and many would rather not manage one. So cashier accounts in CrescendPOS are PIN-based. The invite link is only needed once, at setup. From then on, the cashier logs in with a short PIN at the start of every shift — no email, no typing a long password on a greasy screen.

Because each PIN belongs to one person, every transaction is traceable. Open the audit trail and you see which PIN rang up which sale, which cashier voided an order, and at what time. This is not surveillance for its own sake. It is the difference between "someone made an error today" and "this specific cashier's drawer is short by this amount." When a shift ends and the cash does not match, you can look at the log instead of guessing. Staff who know their actions are traceable also tend to be more careful — that has been the quiet benefit owners report back to us.

Revocation: The Part That Matters Most

F&B staff turnover is real. Baristas leave, kitchen staff move on, and a cafe in a busy area might cycle through several cashiers in a year. With a shared password, a departure means either leaving a hole in your security or changing the password and re-teaching it to everyone — which almost never happens in practice.

With invites, revoking access is one action. Deactivate the account and their PIN stops working immediately. No one else is affected, no shared password needs to be changed, and the audit trail quietly records when their access ended. One click for the owner, zero disruption for everyone else.

What This Means on a Normal Tuesday

A concrete example. Your new cashier starts Wednesday morning. On Tuesday evening you send the invite from your phone, at home, without opening a laptop. By Wednesday they have set their own PIN and taken their first order, and everything they do is logged against their name. Six weeks later they leave. You deactivate the account in ten seconds. The door closes behind them, and no piece of paper under the counter ever changes.

That is the system we wanted: easy enough that owners actually use it, strict enough that the owner always knows who is behind the register.