Skip to main content
PayPunch grants access at three levels that mirror the hierarchy: bookkeeper admins, client users, and employees. Each has its own roles and its own sign-in path.

​
Bookkeeper admins

Admin users belong to a bookkeeper org and manage the whole tenant. There are three admin roles:
Admins sign in at /login with an email and password. A SUPER_ADMIN or ADMIN can invite more admin users to the org — see Users & invitations.

​
Client users (company owners & managers)

Client users belong to a single client company and only ever see that company’s data. There are three client roles:
Client users sign in at /login with an email and password — the same unified page admins use. PayPunch routes them to their company dashboard automatically.

​
Employees

Employees don’t manage anything — they record their own time. Instead of a password, each employee has a 4–6 digit PIN used to clock in and out, typically on a shared time clock device.
  • Employees identify themselves by Employee ID, email, or phone, then enter their PIN.
  • They can clock in/out, take breaks, request time off, view their own timesheet, and correct or resubmit rejected entries.
  • They cannot see other employees, other companies, or any admin settings.
A PIN is a credential. Employees should keep it private and never share it — clock-ins are recorded against whoever’s PIN was used.

​
Impersonation (admins only)

A bookkeeper admin can temporarily impersonate a client user to troubleshoot or help with setup. Impersonation is time-limited and fully audited; while impersonating, the admin is restricted to the client’s view and cannot reach admin-only routes. See Impersonation.

​
Next step

Know your role? Head to Logging in to find the right sign-in URL.