
Send the link however's convenient — chat, email, or just show the QR on screen. The person opens it themselves from there (what they see).

A toggle at the top of the dialog switches the mode:
Both modes let you set the link's lifetime — 1, 7, 30 or 90 days (7 by
default). An expired or revoked /join/... link stops working immediately.
Every link on the "Invited" tab has a ⋮ menu — copy it again, show the QR, or revoke it.
{warning} Revoking a link takes effect instantly: it stops opening even if someone already has it copied or sitting in a chat.
The link opens a public /join/... page — no sign-in required to see it
— that shows which restaurant and role they're being invited to right away.
From there, two paths:
If someone who's already a member opens the link again, that's not an error — the invite simply closes as fulfilled, and it doesn't consume a use.
Settings → Staff shows the whole team: summary cards (total people, devices, who's on shift right now, how many invites are pending, how many roles exist) and the table below them.

The tabs above the list are "All", one per role that has members, "Devices" (once at least one exists) and "Invited". Search matches by name and email.
Clicking a staff row opens a card with their contact details, role, access and hire date — with three actions on it:
"Edit profile" — name, phone, birthday, and the role via a single picker; access is recalculated immediately, to match the new role.

"Reset password" — after a confirmation, issues a new one-time password; the old one stops working right away. The password is shown once — copy it immediately and pass it to the member. This is offered only for someone who works here and nowhere else: a password belongs to the whole account, and one account can serve several restaurants.
"Send reset link" — takes the previous item's place when a one-time password cannot be issued (the person also works elsewhere, or they are an owner). The email goes to the member, they choose the new password themselves, and you never see it.
"Deactivate" — removes the person from the team; access to the restaurant is revoked immediately.
An account signed in via a social provider (no password) has no reset option — only sign-in through that same provider.
A shared tablet at the counter or in the kitchen is not a person: it has no invite and no shift. It does have a role, and its screen sets it: Cashier for an Orders tablet, Cook for a kitchen one. The device's card (the "Devices" tab) shows the role along with the "Access" line and notes, and the "Set up role rights" link opens that role in Roles. That is where the till's rights change — and with them the rights of staff members with the same role (what the device's role decides).
A device doesn't join through a link but through a QR code or a code shown on the tablet itself. The "Add device" button on this screen reminds you of the steps; they're covered in full in Kiosk setup.