---
title: Kiosk
description: A shared tablet for clocking in with a card or a rotating badge, plus visitor and delivery logging
order: 4
---

A kiosk is a shared tablet by the entrance for people clocking in without their own phone
or laptop. It writes the same punches the Clock screen does, so timesheets, the review
queue and presence read it like any other punch.

The Kiosk module ships **turned off** and requires **Attendance** — the switch stays
disabled until Attendance is on. Turn it on at **Workspace settings → Workspace →
Modules**.

## Pairing a tablet

1. Go to **Workspace settings → Kiosk devices** and choose **Pair a kiosk**.
2. A pairing code and QR appear, valid for 10 minutes.
3. On the tablet, open the SquadBear Kiosk app and scan the QR or type the code.
4. Name the device and its location on the tablet. An admin changes both later with
   **Edit kiosk**.

The pairing secret is shown **once**; cancel the enrollment and mint another if lost.

## How people identify themselves

| Method | Works offline | Notes |
|---|---|---|
| Card (NFC) | On a tablet that has seen it | A physical card assigned to a person |
| Badge (QR) | No | A rotating code from **Attendance → Clock → Show my badge** |
| Assisted | Yes | A supervisor punches for someone from the tablet's admin console |

A card resolves offline on a tablet that enrolled it or cached its UID from an earlier
online match. A badge lives 5 minutes and the sheet mints a fresh one after 4, so a
photograph of someone else's screen stops working within 5 minutes.

### Assigning a card

In the tablet's admin console, pick the person under **Employees**, choose **Enroll Badge**,
and hold the card against the reader. One active card per person: a new card retires the
old one, and a card still assigned to a colleague is refused with a 409. The server stores
only a SHA-256 of the card's number, so a lost card is retired by assigning a new one.

## Expired badges

A lapsed badge is reported as expired, not unknown; the person taps **New code** to mint
another.

## Working offline

Punches are queued on the device and sent when the connection returns, stamped with the
time the person stood at the tablet, not the time the link returned.

A punch is trusted from 5 minutes ahead of the server to 72 hours behind it. Outside that
band it is recorded with the server's time and raises an **Attendance review** item. The
item quotes the timestamp the device claimed.

## Turning a kiosk off

- **Revoke** answers the device with 401 on its next request. Flush its queued punches
  first.
- **Permanently purge** deletes the device, its telemetry, and its visitor and delivery
  logs. Refused until the device is revoked. Attendance punches are kept — they record
  which device they came from.

## Visitors and deliveries

A kiosk also signs in guests and logs parcels. The tablet lists the guests still on site;
purging the device deletes both ledgers. A delivery recorded for someone appears in their
data export.

## Worked example

Northlake mounts a tablet in the Building A lobby. Marta pairs it from **Workspace settings
→ Kiosk devices** and enrolls Tomasz's key fob on the tablet. The uplink drops at 07:40;
Tomasz taps at 07:58, and the queued punch lands stamped 07:58 when the link returns at
09:12.

> [!AGENT]
> Show me the open attendance review items raised by system rules and flag any with an implausible device clock.

## Related

- [Attendance review](/docs/attendance/review/)
- [Using the clock](/docs/attendance/clock/)
- [Turn modules on or off](/docs/admin/modules/)