A password alone can be guessed, seen over a shoulder or reused from another website. Two-step sign-in adds a second check: after your password, MediPOS asks for a 6-digit code from an app on your phone. Someone who has your password but not your phone cannot open your pharmacy. It is optional, each person turns it on for themselves, and it is strongly recommended for owners and anyone who can see profit, change prices or manage the team.
The second half of this guide covers sign-out after inactivity: how long a PC may stay signed in without anyone using it.
How to turn on two-step sign-in
- Install Google Authenticator or Microsoft Authenticator on your phone (free, from the Play Store or App Store).
- In MediPOS, open your name at the bottom of the menu and choose My Profile.
- Under Two-step sign-in, click Turn on two-step sign-in. A QR code appears.
- In the authenticator app, add an account and scan the QR code. If the camera does not work, type the key shown next to it instead.
- Type the 6-digit code the app now shows for MediPOS, and click Turn on.
MediPOS then shows 8 recovery codes, once only. Each one signs you in a single time if your phone is lost or broken. Write them down or print the page, and keep them somewhere safe away from the PC, for example with the shop's papers at home.
How sign-in works with it
- Sign in with your email or mobile number and password, as before.
- MediPOS asks for the Code. Open the authenticator app and type the 6-digit code for MediPOS. The code changes every 30 seconds; type the newest one.
If you do not have your phone, type one of your recovery codes instead. Each recovery code works once; My Profile shows how many are left. Click New recovery codes (with your password) to replace them all: the old ones stop working.
The same applies in the MediPOS Windows app: after the password it asks for the code.
PIN sign-in at a registered counter does not ask for the code. There, the registered counter PC itself is the second check (see Counter PIN sign-in and supervisor approval).
How to turn it off
Under My Profile → Two-step sign-in, type your password and a current code from the app (or a recovery code), then click Turn off.
If you lost your phone and your recovery codes, contact MediPOS support from the pharmacy's registered number or email. After checking it is really you, support switches two-step sign-in off, so you can sign in with your password and turn it on again with your new phone.
Sign-out after inactivity
A PC left signed in is signed out by itself after a set time without use: no typing, clicking or scrolling. Anyone who then walks up to it sees the sign-in screen, not your sales and stock.
The owner, or anyone with Manage settings, sets two limits under Administration → Settings → Sign-out after inactivity:
| Setting | Applies to | Starts as |
|---|---|---|
| Office PCs and phones | Every PC and browser that is not a registered counter | 2 hours |
| Counter PCs | PCs registered under Counter PCs, where staff sign in with a PIN | 8 hours |
The choices run from 15 minutes to 24 hours. While someone is working on a page, even one that does not save anything (reading a long report, typing a note), MediPOS knows they are there and does not sign them out. A PC that is simply left open is signed out after the limit, and the next person signs in again: on a counter, by tapping their name and typing their PIN.
In the Windows app the limit works the same way. A PIN sign-in at a counter gets the Counter PCs limit; a password sign-in gets the office one.
Keep me signed in still helps on your own PC: you do not type the password every morning as long as you use MediPOS within the limit. After a longer break, you sign in again.
Common questions
Which authenticator app should I use?
Any app that supports standard 6-digit codes: Google Authenticator, Microsoft Authenticator, Authy or the one built into your password manager. MediPOS never sends the code by SMS.
I changed my phone. What now?
Before you wipe the old phone, move your accounts to the new one with the authenticator app's own transfer option, or turn two-step sign-in off in My Profile and on again with the new phone. If the old phone is already gone, sign in with a recovery code and do the same.
The code is always wrong.
The phone's clock is probably off. Set it to update the time automatically from the network, then try the newest code again.
Can the owner see who has two-step sign-in on?
Turning it on or off, and new recovery codes, are recorded in the audit log under the person's name.
Related guides
Last updated 25 September 2026. Still stuck? Contact us.