Shop Floor Access: Kiosks, Cards, PINs, and Access Profiles

How to give shop floor employees access without an account: kiosk registration, login methods, page access profiles, issuing cards and PINs, and security rules.

Not every shop floor employee needs an account with an email and password. A welder just needs to tap a card to a tablet, see their task, and click "Done."

Shop Floor Access allows a person to log in on-site using a card, QR code, PIN, password, or their own phone. And only to the pages you've allowed.

This article is for owners, administrators, or HR managers who set all of this up.

Who Sets This Up

Owners, administrators, and roles explicitly allowed to manage shop floor access. Other participants cannot issue a PIN or card to themselves or anyone else.

This is an important restriction. If a foreman could issue themselves someone else's PIN, time tracking would lose its meaning.

Three Parts of Setup

Kiosks — devices on the shop floor where people can log in.
Access Profiles — which shop floor pages an employee sees.
Login Methods for Each Person — card, PIN, phone.

1. Kiosks

A kiosk is a tablet or computer in the hall. To register it, open Factory Configuration → Terminals and register a new kiosk. The system will show a QR code and a link. Open them on the tablet itself, and it will remember the registration.

For each kiosk, you choose which login methods are allowed on it.

RFID or NFC card. The employee taps their card to a reader connected to the kiosk.
QR code. The kiosk scans the employee's badge with its camera.
PIN. The employee selects themselves from the list and enters their PIN.
Password. The same, but with a password.
QR on the kiosk screen. The kiosk displays a constantly changing QR. The employee scans it with their phone to clock in/out.

The name, login methods, and automatic logout after inactivity can be changed later. A kiosk can be disabled: then no one will be able to log in on it.

Terminals are linked to a hall. A hall's kiosk shows employees from that hall and those without a hall in the login list.

Which Method to Choose

Card — fastest and most reliable. Requires a reader.
QR badge — inexpensive: the badge is printed on a regular printer. Requires a camera.
PIN — requires nothing, but it can be peeked at or shared with a colleague.

For clocking in and out, a card or badge is better. That's why, by default, after logging in with a PIN, the "Clock In" and "Clock Out" buttons are not available.

2. Access Profiles

An access profile is a set of shop floor pages that an employee sees. For example, an "Operator" or "Welder" profile.

Pages that can be allowed:

operator's panel;
drawings;
cutting;
bending;
products;
production board;
my timesheet;
my schedule.

One profile can be made the default profile: every new employee receives it. For a specific person, the set of pages can be changed in their employee card.

Grant the minimum necessary. A cutting operator doesn't need the production board, but access to drawings is needed by almost everyone.

3. Issuing Cards, PINs, and Passwords

Open the employee's card and the "Shop Floor Access" tab. There you can see all of this person's login methods, when they were used, and issuance buttons.

RFID or NFC card. Tap the card to the reader or enter its number.
QR code. The system will generate a code for printing a badge.
PIN. The system will generate six digits, or you can set your own from four to eight. The previous PIN becomes invalid.
Password. Eight characters or more.
Phone. The employee scans the displayed QR with their phone, and the phone is linked.

PINs and QRs are shown only once. Write them down or print them immediately: the system will not show them again, you will have to issue new ones.

Any method can be revoked. Open sessions with it are terminated immediately. Do this immediately when a person leaves or loses their card.

Shop Floor Service Account

For employees to be able to perform operations from their phones, the owner or administrator selects a shop floor service account. Phones and kiosks technically perform actions in the system on behalf of this account.

The employee themselves is always recorded as the operator of the operation. The service account is only needed for communication.

One Card for Everything

If you have a door lock connected, the shop floor employee's card also opens the door, immediately clocking them in. And vice versa: a door card for a person with an account allows login to a kiosk if they have a production profile.

Security Rules

Login is only possible on a registered kiosk. A card, QR, PIN, or password will not work on an unauthorized device.
Blocking after failed attempts. After five failed attempts, the person is blocked for 15 minutes. After twenty, the kiosk is blocked.
PINs and passwords are not stored in plain text. Only their encrypted hashes are stored, so even an administrator cannot view them.
Clock in and out only on-site. These can be marked with a card on a reader, after logging in with a card or QR badge, or by scanning a QR on the kiosk screen. This QR changes every 30 seconds and is valid once.

The restriction on clocking in/out can be removed for a specific hall in the factory configuration rules. For example, if you have a small workshop and everyone is visible.

Clocking In/Out and Timesheet

Shop floor employee clock-in/out records go into the same timesheet as other employees. Vacations and sick leaves are entered by HR in the employee's card or by the employee themselves via the application.

Typical Setup Order

Register a kiosk in each hall.
Choose login methods for it.
Create access profiles and assign a default profile.
Select a shop floor service account.
For each employee, issue a card or PIN.
Test logging in on the kiosk with one employee.
After that, distribute access to the rest.

Frequently Asked Questions

The kiosk shows people from its hall and those without a hall. Check which hall the employee belongs to.

I didn't write down the PIN, and it disappeared

Issue a new one. The previous one will become invalid.

Kiosk is blocked

There were twenty failed login attempts on it. Wait or check if someone is trying to guess someone else's PIN.

After logging in with a PIN, there is no "Clock In" button

This is by design. Clocking in/out is done with a card, badge, or by scanning the kiosk's QR. The restriction can be removed in the hall rules.

Employee has left

Revoke all their login methods in the employee card and archive them in the shop floor personnel register.