Give every buyer a single sign-on into your Pocketknife portal, then control exactly what each person can see and do. Custom roles map to the permissions that matter, and apply per company location, so a branch admin and an ordering-only buyer get very different portals from the same store.
When a whole account signs in as one user, everyone can do everything and you can't tell who did what. Single sign-on plus roles gives each buyer their own login and only the access their job needs, without you managing passwords.
Buyers sign in through single sign-on rather than juggling extra passwords for your store, so access is quick and centrally controlled.
Build roles from a clear list of permissions and assign them to users, so each person gets exactly the portal their job needs.
Permissions apply per company location, so one person can be an admin at one branch and ordering-only at another under the same account.
Every request is checked against the signed-in user's role for the location they are working in, so access stays correct as teams change.
Buyers authenticate through single sign-on using your OpenID Connect identity provider or Shopify customer accounts, with a one-time code as a fallback.
The user is matched to their B2B company and the location or locations they belong to, so context is set before anything loads.
The role assigned for that location determines which pages and actions show, from viewing orders to approving quotes or managing users.
Account admins invite users, assign roles and revoke access from the portal, so leavers and new starters are handled without a support ticket.
Many B2B stores still hand a whole account one login, which is impossible to control and impossible to audit.
Answers for Shopify Plus B2B teams giving buyers single sign-on and role-based access across company locations, with orders, invoices and pricing tied to ERPs like Pronto Xi, Business Central, Apparel21, ASW, Exact and Oracle E-Business Suite.
Buyers sign in with single sign-on. Pocketknife uses OpenID Connect and Shopify customer accounts, with a one-time email code available as a fallback, so there is no separate password to manage.
Yes. We support SAML and OpenID Connect single sign-on, plus social logins, so buyers can sign in with your existing identity provider or the accounts they already have.
Yes. Sign-in can delegate to an OpenID Connect identity provider so buyers authenticate against your existing directory before entering the portal.
No. Single sign-on and one-time codes mean buyers do not create or manage another password just for the portal.
A role is a named set of permissions. You build roles from permissions like viewing orders, approving orders, requesting quotes, seeing pricing and managing users, then assign them to people.
Roles control access to orders, invoices, quotes and quote approvals, order approvals, pricing, recurring orders, budgets, and user and role management, so each person sees only what they should.
Yes. Roles are assigned per company location, so the same person can be a location admin at one branch and ordering-only at another under the same account.
Only users whose role includes managing users and managing roles can invite people, change roles or remove access, so account administration stays in the right hands.
Yes. Account admins invite users by email, assign a role for the relevant location and send a welcome email, all from the portal.
Yes. Access can be revoked for a single location or across the whole company, so leavers lose access immediately without changing anyone else's login.
Yes. Roles and per-location access are built for B2B companies with multiple buyers, approvers and branches signing in to the same store.
Yes. The signed-in user's role is checked on every request, so permissions are enforced on the pages and actions, not just hidden in the menu.
We will set up single sign-on and the custom roles your accounts need, scoped per location, so buyers get a clean portal and you keep control of who can do what.
Talk through SSO and roles →