How door access works
The device never decides on its own. On every attempt it asks Chronix Hub and opens the door only when the answer is an explicit yes.
Member taps a card, shows a face, a QR or types a code
Device at the door
Chronix Hub checks the live membership
Writes one row to the Live Log
Opens the door, or stays shut. One row is written to the Live Log either way.
Because the answer is computed from the member's live membership at the moment of the tap, there is nothing to sync. Freeze a membership, let it expire, cancel it or revoke a lost card, and the next attempt is refused.
The answer is written to the Live Log before it is sent back, so every attempt is on record, including unknown cards. A typical answer takes a few hundredths of a second in production.
What Chronix Hub checks on every attempt
In this order:
- Is the device key valid, and is it this device's own key?
- Is the device's IP address allowed (if you set an allowlist)?
- Has this device gone over its per-minute rate limit (default 60)?
- Is the device switched on, and is the door switched on?
- Does the card, code or face belong to a member?
- Does that member have an active membership whose plan includes gate access?
- Are both the door's schedule and the plan's schedule open right now, in the studio's timezone?
- Did the same member come through this door within the anti-passback window?
- If you turned it on: do they owe more than the unpaid balance limit?
What members can use
A member can have more than one way in. Each one runs through the same membership check, so the rules never differ between them.
Card or fob
Staff add the card number under the member's Door access tab (read it with the reader). A card belongs to one member at a time; revoke a lost card to free the number.
Face
A face terminal sends its own user id for the person, and you map that id to the member. Chronix Hub stores no photos and no biometric data, only the device's id. Faces the terminal holds that you have not linked appear under Pending enrollments so you can link them in bulk.
QR pass
The member opens My memberships in the portal and shows the Check-in QR. It refreshes every 30 seconds and works once, so a screenshot is useless. Scan it at a web kiosk or any device that reads QR codes.
One-time PIN from the app
The member taps Show PIN in the portal and gets a random 6-digit code, valid for 5 minutes and usable once. Type it on the kiosk or any hardware keypad. There are no saved PINs to share or forget.
QR and PIN options are hidden in the portal when the studio has no active door device, and when a parent is acting for a dependent.
Set up door access, step by step
Everything lives under Access Control in the admin sidebar. Owners and admins can edit. Plan on about ten minutes once you have the device on the network.
Create opening hours (optional)
Schedules tab: weekly windows in the studio's timezone, for example Mon-Fri 06:00-22:00. A window that ends before it starts runs past midnight. No windows means never open.
Create the door
Doors tab: name it, pick a schedule (none means always open) and set its anti-passback time. The default is 60 seconds and 0 turns it off.
Add the device
Devices tab, Add device: name it, choose the vendor, pick the door. Optionally set an IP allowlist (the gym's public IP), a higher rate limit for a busy turnstile bank, and fail open if the door must open during an internet outage.
Copy the key and device ID
The device key is shown once. Paste it into the device or bridge now. Lost it? Regenerate key, and the old one stops working immediately. A web kiosk shows a one-time setup link instead, which you open on the tablet.
Let the plan open the gate
Memberships, edit the plan, turn on Grant gate access and optionally pick a schedule. Tick Apply to current members to push it to people already on the plan; otherwise only new sales get it.
Add credentials
Members, the member, Door access, Add credential: a card number or a face mapping. QR passes and one-time PINs need nothing from you; members get them from the portal.
Test it
Tap a member's card. Within a few seconds the attempt appears in the Live Log with its reason. Nothing in the log usually means the device never reached Chronix Hub: check the key, device ID, IP allowlist and internet.
Pick your hardware
Chronix Hub speaks one simple, vendor-neutral web API. Whether your hardware can use it directly depends on the hardware. These pages cover each option in detail.
Web kiosk (tablet)
Works todayAny tablet with a browser and a front camera. Members type a one-time PIN or show a QR. No wiring, no bridge.
Read the setup guideAny HTTPS-capable device
Works todayA controller, middleware or small script that can make one HTTPS request per tap. Includes a curl example and the JSON contract.
Read the setup guideZKTeco
Needs a bridgeSpeedFace, ProFace and inBio terminals speak their own protocol and need a bridge. Our ZKTeco bridge is planned.
Read the setup guideHikvision
Needs a bridgeDS-K1T face, card and PIN terminals. A bridge on your local network asks Chronix Hub, then opens the door.
Read the setup guideSuprema
Needs a bridgeBioStation, FaceStation and other BioStar 2 devices, connected through the BioStar 2 API or G-SDK.
Read the setup guideKisi
Needs a bridgeCloud-managed readers and controllers. An integration asks Chronix Hub first, then calls Kisi's unlock API.
Read the setup guideProduct names belong to their owners. Chronix Hub is not a certified or official partner of any hardware maker and does not sell hardware.
Reason codes in plain words
Every answer carries a reason. The device gets a short message it can show on screen, and the same reason appears in the Live Log.
| Reason code | In plain words | What to do |
|---|---|---|
active_membership | Let in. | Nothing to do. |
no_active_membership | No membership found for this person. | Sell a membership. |
membership_expired | The membership has ended. | Renew it. |
membership_cancelled | The membership was cancelled. | Sell a new one. |
membership_frozen | The membership is frozen. Frozen members never enter. | Unfreeze it. |
membership_no_gate_access | Their plan does not include entry. | Turn on Grant gate access on the plan and apply it to current members. |
outside_schedule | The plan's hours or the door's hours are closed right now. | Check both schedules (studio timezone). |
antipassback | The same member just came through this door. Also shown for a QR or one-time PIN that was already used. | Wait out the window, or set anti-passback to 0. |
unpaid_balance | They owe more than the limit you set. | Record a payment, or raise the limit. |
unknown_credential | The card, code or face is not registered, was revoked, or the one-time PIN expired or does not exist. | Add the card or face, or have the member tap Show PIN for a fresh code. |
credential_locked | A card was refused too many times for reasons its own plan does not allow, so it is locked for a while even with a valid membership. | Open the member's Door access tab and clear the lockout, or wait it out. |
device_disabled | The reader is switched off. | Enable the device. |
door_disabled | The door is switched off. | Enable the door. |
How a device should read the answer
Hardware and integrators only need these seven outcomes.
| Response | What it means | What the device should do |
|---|---|---|
| 200 with granted: true | Let them in. | Open. |
| 200 with granted: false | A real no. The reason says why. | Stay shut and show the message. |
| 401 | The key is wrong, revoked or missing. | Stay shut. Check the key. |
| 403 | Wrong kind of key, door access is not on the studio's plan, or the IP is not allowed. | Stay shut. Check the allowlist and plan. |
| 404 | The device ID or door does not match this key. | Stay shut. Check the device ID. |
| 429 | Too many attempts this minute. | Stay shut and retry shortly. |
| 5xx or no answer | Something went wrong. | Stay shut, unless Fail open is on and the network is down. |
The golden rule: only granted: true opens the door. Any error means no. Fail open only applies when the device cannot reach Chronix Hub at all; Chronix Hub itself never says yes because of an error.
Troubleshooting
Start at the Live Log. What you see there tells you which side to look at.
| What you see | Likely cause | Fix |
|---|---|---|
| Nothing appears in the Live Log | The device never reached Chronix Hub. 401, 403 and 404 answers are not logged. | Check the key, device ID, IP allowlist and the device's internet access. |
| Device shows Offline | No tap or heartbeat in the last 2 minutes. | Check the device's network and its heartbeat setting. |
| Every tap says unknown_credential | The card is not registered, or was revoked. | Members, the member, Door access, Add credential. |
| A one-time PIN is refused | It was already used, a newer code replaced it, or 5 minutes passed. | Have the member tap Show PIN again and type the new code. A refused attempt for another reason does not use the code up. |
| membership_no_gate_access | The plan does not include entry. | Edit the plan, turn on Grant gate access, tick Apply to current members. |
| outside_schedule at a time the door should be open | The door's schedule or the plan's schedule is closed now. | Check both schedules, in the studio's timezone. |
| antipassback right after a good entry | The same member just came through this door. | Wait out the window or set it to 0. |
| 429 at busy times | The device hit its per-minute limit. | Raise Rate limit on the device (up to 600). |
| No Show PIN or Check-in QR in the member's portal | The studio has no active door device, or a parent is acting for a dependent. | Add and enable a device, or have the member sign in themselves. |
Security settings
A few settings keep a stolen key or a flaky network from turning into an open door.
One key per device
Each device gets its own key, shown once and bound to that device. It can only ask door-access questions. Regenerate the key and the old one dies instantly.
IP allowlist
Add your gym's public IP (up to 50 addresses or ranges). A key copied off a device is then useless anywhere else.
Rate limit
60 attempts a minute per device by default, adjustable up to 600 for a busy turnstile bank behind one device.
Fail open, on purpose
A per-device choice that only matters when the device cannot reach Chronix Hub at all. The device then decides by itself. Leave it off unless the door must open in an outage.
No raw secrets, no biometrics
Card numbers are never stored in the clear and logs show the last 4 digits only. Faces are an opaque device id, never a photo or template. One-time PINs and QR passes are short-lived and single use.
Lockouts and alerts
A card that keeps being refused for plan reasons is locked for a while (default: 5 misuse refusals in 10 minutes locks it for 30). Owners and admins get alerts for bursts of refusals and unknown credentials, with at most about 6 emails an hour.
Prefer the story version?
Our blog post walks through turnstiles, readers and kiosks from the studio owner's point of view.
Read: Gym door access control, explainedFrequently asked questions
Does Chronix Hub sell door hardware?
No. Chronix Hub is the software side: it answers "may this person enter?". You bring the turnstile, reader, controller or tablet. Product names belong to their owners and Chronix Hub is not a certified or official partner of any hardware maker.
Which hardware works today?
A web kiosk (any tablet with a browser) and any controller, middleware or script that can make an HTTPS request on every tap. ZKTeco, Hikvision, Suprema and Kisi need a bridge or integration written against the open API. Our ZKTeco bridge is planned, with no release date yet.
What do members need on their phone?
Nothing for a card or face. For a QR pass or a one-time PIN they open the Chronix Hub member portal for your studio and go to My memberships.
Are PINs still saved on a member's profile?
No. PINs are one-time 6-digit codes the member generates in the portal. Each is valid for 5 minutes and works once. Making a new one replaces the previous one.
What happens if the internet goes down?
The device cannot ask Chronix Hub, so it stays shut unless you enabled Fail open for that device. A web kiosk shows a notice and ignores input; nothing is queued, and nobody is let in later. It retries every 10 seconds and recovers by itself.
Do frozen or expired members get in?
No. The check uses the live membership, so the very next tap after a freeze, expiry or cancellation is refused.
Can I limit when members can enter?
Yes, in two places. A door can have a weekly schedule, and each membership plan can have its own. Both must be open at the moment of the tap.
Can I turn people away over unpaid balances?
Optionally. Under Studio Settings, Payments, set a Gate: unpaid balance amount. Members who owe more than it are refused. Leave it empty to ignore balances.
Are face photos stored?
No. The face terminal keeps its own faces. Chronix Hub only stores the terminal's user id for the person, mapped to a member.
Is door access included in my plan?
Door access is a plan feature. If Access Control is missing from your admin sidebar, contact us and we will check your plan.
Want to see door access on your own studio?
Book a short demo and we will walk through your door, your hardware and your membership plans.