Credentials and Access Profiles

What This Page Covers

This page explains how credentials and access profiles work together to grant time-based access through doors. It covers the four credential types, how to manage them, and how to define the time-based policies that control access to specific doors.

---

Credentials

Overview

A credential is an authentication method — the "key" that a user presents to prove their identity and gain access. The platform supports four credential types, each suited to different authenticators:

Type	Presented at	Use Case
PIN	Keypad	Numeric code entered by the user (4–10 digits)
NFC	Card/NFC Reader	Proximity card or tag held near the reader
FINGERPRINT	Fingerprint Scanner	Biometric match performed by the scanner
WEB	Mobile app or API	Secure token used for app-based or programmatic unlock

Each credential type has different security and provisioning characteristics:

• PIN, NFC, FINGERPRINT: Stored and validated on the hub (edge runtime). The authenticator validates the credential locally, enabling offline access even if cloud connectivity is intermittent.
• WEB: Validated only in the cloud. Never stored on the hub. Used for app-based unlock or integration scenarios.

---

Creating and Managing Credentials

PIN Credentials

When you create a PIN credential, the system generates a random 4–10 digit code. You can specify the PIN length at creation time (default: 6 digits).

When you reset a PIN, a new random PIN is generated and returned to you. You can also deactivate a PIN without resetting it (the credential remains but cannot be used).

NFC Credentials

NFC credentials store the device ID of a proximity card or tag. The system validates the card's unique identifier against the configured NFC credentials.

Fingerprint Credentials

Fingerprint credentials store the biometric template from a fingerprint reader. The reader performs the biometric match locally; the platform simply records which fingerprint credentials are active on each authenticator.

WEB Credentials

Web credentials generate a secure 256-bit random secret. Like PINs, the secret is shown only at creation time and cannot be retrieved later.

Web credentials are never pushed to the hub. They are used for mobile app unlock or API-based access through a public unlock endpoint. The token proves identity; the credential is authenticated against active access profiles.

Credential Lifecycle

Credentials move through simple states:

• Active: Can be assigned to access profiles and used for authentication
• Inactive: Still exists but cannot be used; will not be synchronized to authenticators
• Deleted: Soft-deleted and hidden from normal views; cannot be used

When you deactivate a credential, all access profiles using that credential are automatically deactivated. When you delete a credential, all deactivated profiles using it are also deleted.

---

Access Profiles

Overview

An access profile (or just "profile") defines when a credential is allowed to be used and which doors it grants access to. It's the bridge between credentials and access points.

A single credential can have multiple profiles, allowing the same "key" to grant different access depending on day, time, and location. For example:

• Alice's office PIN might grant access to her office (Monday–Friday 8am–5pm) via Profile A
• The same PIN might grant access to the conference room (Monday–Friday 9am–4pm) via Profile B
• The same PIN might grant 24/7 access to the emergency exit via Profile C

Each profile is independent: activating or deactivating one doesn't affect others.

Profile Structure

A profile consists of:

• A credential — the PIN, card, fingerprint, or web token being used
• A validity window — an absolute start and end date (e.g., "valid from January 1 to December 31")
• Weekly schedule rules — which days and times the credential is active (e.g., "Monday–Friday 8am–5pm")
• Access point assignments — which doors this credential can unlock via this profile

Weekly Schedule Rules

Schedule rules define when a profile is active within a calendar week:

Monday–Friday: 08:00–17:00  (office hours)
Saturday: 09:00–12:00        (morning access only)
Sunday: off                   (no access)

Each rule specifies:

• A start time and end time (24-hour format, e.g., 08:00, 17:00)
• Which days of the week this rule applies to

A profile can have multiple rules, allowing flexible schedules like office hours on weekdays and different hours on weekends.

Assigning Profiles to Access Points

Once a profile exists, you can assign it to one or more access points. When you assign a profile to an access point:

1. The system pushes the profile and its rules to the hub
2. Each authenticator on the access point receives the credential and schedule
3. The authenticators confirm they've received and provisioned the credential

If you assign the same profile to multiple access points, all authenticators on all those doors receive the same credential and schedule. Revoking the profile from one access point doesn't affect others.

Profile Activation and Deactivation

Profiles have a desired state (what you want) and a computed state (what the authenticators report back):

• Activated: The credential is actively provisioned to the authenticators and can be used
• Deactivated: The credential has been removed from the authenticators and cannot be used
• In Progress: Some authenticators are still provisioning or deprovisioning
• Error: One or more authenticators failed to provision or deprovision the credential

You can activate and deactivate profiles independently on each access point. Deactivating a profile removes the credential from all authenticators on that access point without affecting other access points.

Capacity and Overlap Constraints

Access points have limits on how many credentials and schedules can be active simultaneously:

Limit	Meaning
maxUsers	Maximum number of active user credentials
maxSchedules	Maximum concurrent access profiles per access point
maxScheduleCommandSlots	Total weekly schedule slots across all active profiles

When you try to assign a profile:

1. The system checks if adding this profile would exceed capacity limits
2. The system checks for credential overlap (the same credential cannot be active on the same authenticator in overlapping time windows)
3. If constraints are violated, the assignment is rejected

These limits ensure that the authenticators can manage the provisioned credentials and schedules correctly.

Credential Overlap and Multiple Authenticators

If an access point has multiple authenticators (e.g., a keypad AND a card reader on the same door):

• All authenticators on the same access point must have the same set of active credentials
• A credential cannot have two overlapping profiles on the same authenticator
• When you assign a profile, it is pushed to all authenticators on that access point

This ensures consistent access policy across all ways to authenticate to the same door.

Time Window Semantics

An access profile is active only when all three conditions are met:

For example, if a profile's validity window is January–December, and it has a rule for Monday–Friday 8am–5pm:

• Tuesday at 10am: ✅ Access granted (all conditions met)
• Tuesday at 6pm: ❌ No access (outside office hours)
• Saturday at 10am: ❌ No access (not a scheduled day)
• December 31 at 11:59pm: ❌ No access (outside time window if activeTo is earlier)

Managing Profiles

You can:

• Create a profile with a credential, validity window, and schedule rules
• Update a profile's name, description, validity window, or schedule rules
• Activate/deactivate a profile on a specific access point
• Bulk deactivate all profiles using a credential (useful for quickly revoking access when a credential is compromised)
• Delete a profile (only if all profiles assigned to access points are deactivated)

---

How Credentials and Profiles Work Together

Credential-Profile-AccessPoint Relationship

A single credential can be used by multiple profiles, each granting access to different doors with different schedules:

This allows:

• Same credential, different access: Alice's PIN grants different access at different doors
• Independent management: Deactivating Profile A doesn't affect B or C
• Flexible policies: Each door can have its own schedule and policies

Access Flow

When a user presents a credential at an authenticator:

1. The authenticator validates the credential (PIN code, NFC card ID, fingerprint match)
2. The authenticator looks up all active profiles using that credential
3. The system evaluates the current day and time against each profile's schedule rules
4. If a profile matches (credential valid, day/time match, profile activated on this access point), the door is unlocked
5. The access event is recorded in the audit log

Hub-Based vs. Cloud-Based Validation

• PIN/NFC/FINGERPRINT: Validated entirely on the hub. The credential and schedule rules are provisioned to the authenticator locally, so access works even if cloud connectivity is lost.
• WEB: Validated only in the cloud. The credential is never stored on the hub; validation happens at the cloud unlock endpoint. Cloud connectivity is required for WEB credential access.

This means:

• PIN/NFC/FINGERPRINT credentials provide offline resilience
• WEB credentials provide centralized control but require cloud connectivity

---

Where to Continue

Goal	Page
Learn how to configure access points and doors	Access Points
Understand roles, permissions, and audit logging	Roles, Permissions & Audit
See the core Access Control model and architecture	Overview