TURN 1 Auth0 login - ideation

The shop signs in through Auth0 once; the shared device stays trusted; staff pick a profile and unlock with a PIN. Two directions - full first-run path 1a and the everyday lean lock screen 1b - plus the never-locked-out fallback for a solo owner on vacation.

The model - Auth0 Organizations + trusted-device PIN MOM-AND-POP · NO SHOP-SIDE SSO

1Shop signs in once

Each shop is an Auth0 Organization. The owner signs in via Universal Login with MFA, establishing a trusted session on the shop iPad. 500 shops = 500 orgs, unlimited on a paid B2B plan.

2Staff pick a profile

Every employee is an org member. On the trusted device they show as profiles - tap a name to switch. Profiles are people, not devices, so MAU stays tied to real headcount.

3Cashiers unlock with a PIN

Floor roles carry a kiosk role exempt from per-user MFA - a 4-digit PIN against the device's Auth0 session. Refunds & settings step-up to admin re-auth.

Full path - Universal Login → Profiles → PIN, + solo-owner fallback

What the owner sees setting up (or re-trusting) the shop iPad, and how the floor never gets stranded.

STEP 1Auth0 Universal Login

TintPro NEXT · shop workspace

maya@sunshinetint.com

Password

••••••••••

Continue

Secured by Auth0 · org: sunshine-tint

STEP 2MFA - owner only, once per device

Verify it's you

Owner sign-in needs 2-step
verification once per iPad

4 1 9

Or approve on Auth0 Guardian

At enrollment we print recovery codes
for the shop safe - see fallback →

Only the owner is MFA-enrolled

STEP 3Device trusted

This iPad is signed in
to Sunshine Tint

Keep this device trusted

Rolls forward on daily use · no MFA for floor

Techs & cashiers now unlock with a
PIN - no 2-step needed.

Choose who's working →

STEP 4Profile picker

Who's working?

Sunshine Tint · Stuart, FL

Maya

OWNER

Jordan

TECH

Sam

TECH

Rosa

CASHIER

Each profile is protected by a PIN

STEP 5Cashier PIN - no 2FA

Hi Rosa

CASHIER · PIN ONLY

Verified against the device's Auth0 session - works even though Rosa has no 2FA.

EDGESensitive action → step-up

Refund needs an admin

Voids, refunds & settings are above a cashier's role. Ask an owner/manager to approve.

Approve on owner's phone

Enter manager PIN

Guardian push completes from anywhere -
the manager needn't be in the shop.

"What if the session expires and the owner is on vacation?"

Session rolls forward on daily use, so it realistically only lapses when the shop is closed anyway. If it does, the re-trust screen (→) never dead-ends a cashier: it offers three parallel routes, so no single unreachable person can lock out a shop. Ship the floor app as native / TWA, not a bare Safari PWA, so token storage survives restarts.

FALLBACKSession expired → re-trust

Let's re-trust this iPad

The shop's secure session lapsed.
Pick whichever is easiest:

Approve on owner's phone

Push to Maya - works from the beach

Enter a recovery code

Printed at setup - kept in the shop safe

Contact TintPro support

We run the Okta org - the final backstop

No route needs the owner physically present, and route 3 needs no owner at all.

Owner reachable

Guardian push to their phone. MFA is location-independent - vacation is fine. ~20 seconds.

Owner unreachable, codes on hand

A one-time recovery code from the safe re-trusts the device with no owner in the loop at all.

Everything else

Because we own the Okta org, TintPro support can verify the shop and issue a temporary re-trust. No shop ends permanently locked out.

Where a shop has a second trusted person (spouse, lead tech), enroll them too - then route 1 has two owners to reach.

Everyday lean lock screen - profiles + PIN on one surface

The 99% case. Device already trusted; opening the app lands here. No Auth0 chrome - that lives behind setup and re-trust only.

DAILYOpen app → pick + PIN

Sunshine Tint

Stuart, FL

TRUSTED

Tap your name

Maya

Jordan

Rosa

Sam

RESULTOn the board in ~2s

Welcome, Rosa

Front desk · clocked in 2:14 PM

Open Shop Board

Switch user anytime - top-right avatar

Refunds & settings still prompt for an admin - cashier scope is enforced after unlock.

1a vs 1b: 1a is the setup / recovery surface an owner sees rarely; 1b is what the floor touches every shift. They're the same system - build both, but optimize 1b for speed and 1a for never being stranded.