How can I limit the cashier payment workflow to specific desktops?

WARP by itself is not a strong identity for a particular physical computer, since someone could install it on another PC. For a tighter restriction, use device certificates or a device-posture check and require that condition in the Access policy for the payment workflow. The certificate has to be installed on each approved machine and renewed or replaced when necessary.

The free tier may cover the basic Zero Trust and Access setup, but the bigger issue is administration. Since these are unmanaged computers on ordinary home or branch internet connections, you’ll need to manually install and maintain WARP, distribute certificates, and handle lost or replaced machines. There is no completely reliable free way to identify a specific desktop using only its changing public IP address.

Keep the cashier function separate from read-only access at both the application and authorization layers. Restricting the URL alone is not enough; the backend should independently verify the user’s role and the device requirement before accepting a payment record. Device restrictions reduce risk, but unmanaged PCs should still be treated as potentially compromised.

Cloudflare Zero Trust with WARP is a reasonable starting point. You can install WARP on the approved desktops and create an Access policy that allows the cashier endpoint only when the request comes through those devices. The general fee-reading pages can use a separate, less restrictive policy.