Shopify POS staff permissions
POS permissions are set per POS role, not by editing admin staff permissions
Direct answer. Point of Sale permissions live on a POS role: a named set of permissions you assign to POS staff, separate from the admin user-role permissions that control Shopify admin. Shopify Help Center states that you need to assign a role, and that each Point of Sale staff needs an assigned role. Discount and refund rights sit on that role: Apply custom discounts, Apply discount codes, and Return and exchange orders, each set to Allowed, Denied, or Approval required. Confirm the live Help Center pages; Shopify can change labels. This page is not legal advice.
Staff Access Audit Guard (Shopify App Store · Write a review) reviews installed app access, granted scopes, staff access records, and ownership evidence without reading customer or order data. It does not revoke staff or change POS roles. This page is the Help Center reading aid for POS roles versus admin permissions — not the leftover-admin self-score.
Related: Agentic Catalog by momiji — Crawler rules and complete product JSON-LD for shopping agents.
Free check first: App access scope reader runs in your browser and sends nothing. Paste an app’s access scopes and see which touch customer data or can write.
Checklist: review discount and refund rights
- Open the POS role pages Shopify documents, not only Settings > Users admin roles.
- Confirm each POS staff member has an assigned POS role. Shopify says every Point of Sale staff member needs one.
- On that role, read Apply custom discounts and Apply discount codes (Allowed, Denied, or Approval required).
- On that role, read Return and exchange orders and the related return permissions Shopify lists (ineligible items, unverified returns, complete in-progress returns, restock).
- If Approval required is set, confirm who holds manager-approval plus the matching Allowed permission, because Shopify says that person enters a PIN.
POS roles are not admin staff permissions
Shopify’s Understanding Shopify POS staff management page describes POS roles as a named set of permissions for POS app activities — processing returns, adding discounts, cash tracking, and similar register actions. It states that you cannot assign individual permissions to Point of Sale staff; you assign a role. Custom POS roles are documented for locations on the POS Pro subscription. Admin user roles, documented under Users and permissions, control Shopify admin. A staff member can hold both an admin role and a POS role; changing one does not rewrite the other.
The same POS staff-management page notes that a POS role applies when the staff member uses a PIN at a POS Pro location. A permission denied on the POS role can still be available when that person works in Shopify admin, if their admin role allows it. Confirm the live Help Center wording for your plan and location type.
Where discount and refund rights sit
The Point of Sale permissions table lists each POS permission and the Allowed / Denied / Approval required options. For money off the cart, Shopify names:
- Apply custom discounts — custom discounts on the cart or a line item.
- Apply discount codes — discount codes on the cart.
For refunds and exchanges, Shopify names Return and exchange orders, with separate permissions for returning ineligible items, creating unverified returns, completing in-progress returns, managing restock, and cancel. The Help Center page on processing returns and refunds in Shopify POS says staff must have Return and exchange orders to refund, plus those extra permissions for the extra actions. Approval required means a staff member who has manager approval and the matching Allowed permission enters their PIN.
Shopify also documents that high-risk register actions such as voids, refunds, and manual discounts are attributed to the staff member who performed them, and that you can review them in the POS activity log. That log is an activity record, not an access-audit score.
What this page is not
- Not legal advice, a security attestation, or employee monitoring.
- Not a substitute for the live Help Center pages, which Shopify can update.
- Not the leftover-admin 2FA and publish-rights score. That URL is staff permissions audit checklist.
Related pages
- App access scope reader — paste scopes and see which touch customer data
- audit staff permissions
- Staff permissions audit checklist — leftover Admin access, not POS roles
- Hide past POS order history from temporary staff — past orders at a location, not the POS role list
- Shopify collaborator permissions — collaborator roles, not POS roles
- Staff Access Audit Guard — live App Store listing
- Point of Sale permissions
- Understanding Shopify POS staff management
- Shopify apps hub
- Tools
Not legal advice. Confirm the live Shopify Help Center pages before you treat a POS role as granting or denying a register action. The app scores and flags access you already granted; it does not change POS roles.