Skip to main content
Kiosk Mode turns one physical device into a shared sign-in point for your team.

​
Purpose

Many pools have a device — a front-desk iPad, a wall-mounted tablet by the mechanical room — that many different staff members use throughout a shift to log chemical records or maintenance work. Asking each person to sign in with an email and password every time they walk up isn’t practical. Kiosk Mode solves this: an admin enrolls the physical device once, each staff member sets a short PIN for themselves, and from then on anyone on that device’s team can tap their name and enter their PIN to get a real, fully signed-in session.

​
Best for

  • shared front-desk or poolside tablets used by multiple staff across a shift
  • fast sign-in for chemical record and maintenance logging without typing a password each time
  • teams that want a normal, permission-respecting session (not a limited “guest” mode) behind a quick PIN

​
How a device becomes a kiosk

Go to:
Anyone with the users:edit permission can enroll a device, but enrollment must happen from the browser on the physical device itself — selecting Enroll this device locks the browser you’re currently using to your organization by setting a secure, invisible cookie. You don’t handle or copy any token; there’s nothing to type in — a success toast confirms the device is enrolled. Each enrolled device shows its name and enrollment date in the same panel, with a Revoke button. Revoking a device is permanent for that browser — a revoked device stops appearing in the sign-in flow and can’t be un-revoked; if you need it back, enroll it again. Revoked devices are hidden from the active list, but a count is still shown (for example, “2 revoked devices hidden”). Visiting /kiosk on a device that was never enrolled (or whose enrollment was revoked) shows “This device isn’t enrolled” with a link back to normal sign-in.

​
Setting up your own kiosk PIN

Go to:
This page is self-service — any signed-in user can set their own PIN, no special permission is required. Fields:
  • New PIN (4-8 digits) — numeric only; non-digit characters are stripped as you type
  • Confirm PIN — must match exactly
Validation happens client-side before saving: the PIN must match 4-8 digits and the two fields must match, or you’ll see an error toast (“PIN must be 4-8 digits” / “PINs don’t match”). There’s no other complexity requirement (no “must include a non-repeating digit” rule, etc.). Saving replaces any existing PIN outright — there’s no “current PIN” confirmation step. Setting a new PIN also clears any lockout on your account, so if you’re ever locked out at a kiosk, setting a fresh PIN from a normal sign-in immediately restores kiosk access.

​
Signing in at a kiosk

1

Open the kiosk device

Visiting /kiosk on an enrolled device shows a “Who are you?” screen with a tile for every active team member who both belongs to that device’s organization and has a user profile — no scrolling list or search, just tap your name.
2

Enter your PIN

Tapping a name opens a numeric keypad. Dots track how many digits you’ve entered. Enter is disabled until you’ve typed at least 4 digits (max 8); Not you? returns to the name picker.
3

Submit

Submitting checks your PIN against the name you tapped. If it matches, the kiosk establishes a real signed-in session and takes you to the dashboard — the same as signing in normally.

​
What happens on failure

  • A wrong PIN always shows the same generic “Incorrect PIN” message — whether the PIN is wrong, the person has no PIN set yet, or (as an internal safeguard) the tapped profile turns out not to actually belong to this device’s organization. This is intentional: it avoids revealing which of those is true.
  • Every attempt (success or failure) is recorded internally against the device and user for audit purposes, though there’s currently no admin screen that surfaces that history.
  • After 5 consecutive failed attempts, the account locks for 15 minutes — you’ll see a distinct message (“Too many attempts — try again in N minutes”) instead of the generic one. The lockout is per-user, not per-device, so it follows the person across any kiosk. It clears automatically once the 15 minutes pass, or immediately if that person sets a new PIN from Settings > Kiosk PIN.
  • PINs are checked against the specific name you tapped, not looked up globally — two different people can use the same PIN without conflict.

​
Signed-in kiosk sessions

Once a PIN check succeeds, the session that’s created is a normal, fully-permissioned sign-in for that person — kiosk sign-in is a different front door into the same account, not a stripped-down “guest” mode. There’s no reduced feature set or extra access restriction layered on top. The only behavioral differences from a normal desk sign-in:
  • Idle auto sign-out. A kiosk-originated session signs itself out after 5 minutes of no mouse movement, clicks, key presses, touches, or scrolling — so the next person at the shared device doesn’t inherit an open session. A normal password sign-in never does this.
  • Sign-out destination. Signing out (manually, or via the idle timeout) from a kiosk session returns to the /kiosk name picker instead of the normal /login page.

​
Multi-org behavior

If someone belongs to more than one organization, kiosk sign-in resolves membership against the enrolled device’s organization, checked live against Clerk at the moment of sign-in — not the organization_id stored on their user profile row, which only reflects whichever org their profile happened to be created under first and can be stale for a multi-org member. In practice this means:
  • The name picker only lists people who are currently real members of the device’s organization, regardless of what org is “home” for their profile.
  • If someone is removed from an organization, they immediately stop appearing at that organization’s kiosks and can no longer PIN-sign-in there, even if their profile row hasn’t caught up.
  • The same live-membership check applies when an admin resets someone’s kiosk PIN from Settings > Users — you can only reset a PIN for someone who is a real, current member of your organization.

​
Permissions

  • users:edit — required to enroll a kiosk device, view the list of enrolled devices, revoke a device, view which users currently have a kiosk PIN set, and reset another user’s kiosk PIN.
  • No permission is required to set or replace your own kiosk PIN — that’s available to any signed-in user from Settings > Kiosk PIN.
Admins manage individual users’ PINs from Settings > Users: each row shows whether that person has a kiosk PIN set, with a Reset kiosk PIN action (disabled if they don’t have one). Resetting clears their PIN entirely — they’ll need to set a new one before they can use any kiosk again.

​
Best practices

  • only enroll a device you’re physically holding — enrollment locks that specific browser, not an account or user
  • name devices clearly by location (Front Desk iPad, Pool Office Tablet) so revoking the right one later is easy
  • revoke a device immediately if it’s lost, replaced, or decommissioned — there’s no way to temporarily disable one, only revoke and re-enroll
  • treat kiosk PINs like a short shared-device password, not a secret on par with an account password — encourage staff not to reuse a meaningful password as their PIN
  • if someone leaves the pool’s device unattended and locked out, they can clear it themselves by setting a new PIN from a normal sign-in, rather than waiting out the 15-minute lockout

​
Suggested screenshots

  • Settings > Organization > Kiosk Devices panel, with the enroll dialog open
  • Settings > Kiosk PIN self-service form
  • kiosk device “Who are you?” name-picker screen
  • kiosk PIN-entry keypad screen
  • the “Too many attempts” lockout message
  • Settings > Users row showing the “Reset kiosk PIN” action