Let staff verify Support PINs without revealing them in Blesta
PD Support PIN separates checking the value supplied by a caller from permission to reveal or regenerate the stored PIN. Use Staff access to give front-line staff a blind-verification workflow while keeping reveal and regeneration with the roles that need them.
Check the two permission layers
The person must first have a staff group allowed to use the PD Modules plugin. The module’s Staff access controls do not grant that platform permission. They decide what an already authorised member of staff can do with PINs.
The built-in administrator role retains full access. Until you configure Staff access, roles may reveal and regenerate PINs. Plan which roles need those abilities before rolling the process out.
Configure a verification-only role
- Using an administrator account, open PD Modules → PD Support PIN → Staff access.
- Find the role that should check callers without viewing or replacing PINs.
- Untick that role’s reveal/regenerate permission and apply the change.
- Use an authorised test staff account in that role to open Verify.
- Select a test client and check a PIN supplied by that client. Verify that the role can still obtain match or no-match.
- Check that Reveal, Reveal PINs and Regenerate are unavailable to that role.
Use a test account you control for permission checks and keep PIN values out of screenshots. Do not use a built-in administrator account to judge the restricted role’s behaviour, because it retains full access.
Understand masking versus permission
Hide the PIN until clicked (reveal-on-click) masks PINs for staff who may reveal them. It does not remove their Reveal permission. Staff access restrictions remove the ability and keep the PIN masked for that role even when display masking is disabled.
Check the client’s profile and the Verify/Client PINs screens. Blesta does not provide the module’s PIN panel in its admin ticket view.
Review activity after changing access
Open Report & Activity → Activity to review the relevant verification and reveal events. Check the event, client, time and By column rather than treating a match as permission to carry out every requested account change.
Confirm the staff account’s actual role and platform access before treating a difference as a module fault.
Check the configured permissions
Check the staff account’s actual role or group, its platform permission to open PD Modules, and the separate Staff access choice. Display masking does not remove permission to reveal a PIN. Use an account your team controls to verify the intended permissions; do not reveal or regenerate a customer’s PIN to make a failed caller check pass.
See how Support PIN verification works in Blesta for the overall workflow, or explore PD Support PIN.
