Door access docs

Gym door access control with Chronix Hub

A turnstile, reader or tablet asks Chronix Hub "may this person come in right now?" and gets a yes or no in one call. The answer comes from the member's live membership, so freezing, expiring or cancelling takes effect on the very next tap.

Cards, faces, QR and one-time PINsOpen HTTPS APIEvery attempt logged

Updated October 2026

How door access works

The device never decides on its own. On every attempt it asks Chronix Hub and opens the door only when the answer is an explicit yes.

Member taps a card, shows a face, a QR or types a code

Device at the door

"May this person enter?"Yes, welcome Sara / No, membership frozen

Chronix Hub checks the live membership

Writes one row to the Live Log

Opens the door, or stays shut. One row is written to the Live Log either way.

There is no syncing and no member list stored on the device for Chronix Hub to keep up to date.

Because the answer is computed from the member's live membership at the moment of the tap, there is nothing to sync. Freeze a membership, let it expire, cancel it or revoke a lost card, and the next attempt is refused.

The answer is written to the Live Log before it is sent back, so every attempt is on record, including unknown cards. A typical answer takes a few hundredths of a second in production.

What Chronix Hub checks on every attempt

In this order:

  1. Is the device key valid, and is it this device's own key?
  2. Is the device's IP address allowed (if you set an allowlist)?
  3. Has this device gone over its per-minute rate limit (default 60)?
  4. Is the device switched on, and is the door switched on?
  5. Does the card, code or face belong to a member?
  6. Does that member have an active membership whose plan includes gate access?
  7. Are both the door's schedule and the plan's schedule open right now, in the studio's timezone?
  8. Did the same member come through this door within the anti-passback window?
  9. If you turned it on: do they owe more than the unpaid balance limit?

What members can use

A member can have more than one way in. Each one runs through the same membership check, so the rules never differ between them.

Card or fob

Staff add the card number under the member's Door access tab (read it with the reader). A card belongs to one member at a time; revoke a lost card to free the number.

Face

A face terminal sends its own user id for the person, and you map that id to the member. Chronix Hub stores no photos and no biometric data, only the device's id. Faces the terminal holds that you have not linked appear under Pending enrollments so you can link them in bulk.

QR pass

The member opens My memberships in the portal and shows the Check-in QR. It refreshes every 30 seconds and works once, so a screenshot is useless. Scan it at a web kiosk or any device that reads QR codes.

One-time PIN from the app

The member taps Show PIN in the portal and gets a random 6-digit code, valid for 5 minutes and usable once. Type it on the kiosk or any hardware keypad. There are no saved PINs to share or forget.

QR and PIN options are hidden in the portal when the studio has no active door device, and when a parent is acting for a dependent.

Set up door access, step by step

Everything lives under Access Control in the admin sidebar. Owners and admins can edit. Plan on about ten minutes once you have the device on the network.

  1. Create opening hours (optional)

    Schedules tab: weekly windows in the studio's timezone, for example Mon-Fri 06:00-22:00. A window that ends before it starts runs past midnight. No windows means never open.

  2. Create the door

    Doors tab: name it, pick a schedule (none means always open) and set its anti-passback time. The default is 60 seconds and 0 turns it off.

  3. Add the device

    Devices tab, Add device: name it, choose the vendor, pick the door. Optionally set an IP allowlist (the gym's public IP), a higher rate limit for a busy turnstile bank, and fail open if the door must open during an internet outage.

  4. Copy the key and device ID

    The device key is shown once. Paste it into the device or bridge now. Lost it? Regenerate key, and the old one stops working immediately. A web kiosk shows a one-time setup link instead, which you open on the tablet.

  5. Let the plan open the gate

    Memberships, edit the plan, turn on Grant gate access and optionally pick a schedule. Tick Apply to current members to push it to people already on the plan; otherwise only new sales get it.

  6. Add credentials

    Members, the member, Door access, Add credential: a card number or a face mapping. QR passes and one-time PINs need nothing from you; members get them from the portal.

  7. Test it

    Tap a member's card. Within a few seconds the attempt appears in the Live Log with its reason. Nothing in the log usually means the device never reached Chronix Hub: check the key, device ID, IP allowlist and internet.

Pick your hardware

Chronix Hub speaks one simple, vendor-neutral web API. Whether your hardware can use it directly depends on the hardware. These pages cover each option in detail.

Reason codes in plain words

Every answer carries a reason. The device gets a short message it can show on screen, and the same reason appears in the Live Log.

Reason codeIn plain wordsWhat to do
active_membershipLet in.Nothing to do.
no_active_membershipNo membership found for this person.Sell a membership.
membership_expiredThe membership has ended.Renew it.
membership_cancelledThe membership was cancelled.Sell a new one.
membership_frozenThe membership is frozen. Frozen members never enter.Unfreeze it.
membership_no_gate_accessTheir plan does not include entry.Turn on Grant gate access on the plan and apply it to current members.
outside_scheduleThe plan's hours or the door's hours are closed right now.Check both schedules (studio timezone).
antipassbackThe same member just came through this door. Also shown for a QR or one-time PIN that was already used.Wait out the window, or set anti-passback to 0.
unpaid_balanceThey owe more than the limit you set.Record a payment, or raise the limit.
unknown_credentialThe card, code or face is not registered, was revoked, or the one-time PIN expired or does not exist.Add the card or face, or have the member tap Show PIN for a fresh code.
credential_lockedA card was refused too many times for reasons its own plan does not allow, so it is locked for a while even with a valid membership.Open the member's Door access tab and clear the lockout, or wait it out.
device_disabledThe reader is switched off.Enable the device.
door_disabledThe door is switched off.Enable the door.

How a device should read the answer

Hardware and integrators only need these seven outcomes.

ResponseWhat it meansWhat the device should do
200 with granted: trueLet them in.Open.
200 with granted: falseA real no. The reason says why.Stay shut and show the message.
401The key is wrong, revoked or missing.Stay shut. Check the key.
403Wrong kind of key, door access is not on the studio's plan, or the IP is not allowed.Stay shut. Check the allowlist and plan.
404The device ID or door does not match this key.Stay shut. Check the device ID.
429Too many attempts this minute.Stay shut and retry shortly.
5xx or no answerSomething went wrong.Stay shut, unless Fail open is on and the network is down.

The golden rule: only granted: true opens the door. Any error means no. Fail open only applies when the device cannot reach Chronix Hub at all; Chronix Hub itself never says yes because of an error.

Troubleshooting

Start at the Live Log. What you see there tells you which side to look at.

What you seeLikely causeFix
Nothing appears in the Live LogThe device never reached Chronix Hub. 401, 403 and 404 answers are not logged.Check the key, device ID, IP allowlist and the device's internet access.
Device shows OfflineNo tap or heartbeat in the last 2 minutes.Check the device's network and its heartbeat setting.
Every tap says unknown_credentialThe card is not registered, or was revoked.Members, the member, Door access, Add credential.
A one-time PIN is refusedIt was already used, a newer code replaced it, or 5 minutes passed.Have the member tap Show PIN again and type the new code. A refused attempt for another reason does not use the code up.
membership_no_gate_accessThe plan does not include entry.Edit the plan, turn on Grant gate access, tick Apply to current members.
outside_schedule at a time the door should be openThe door's schedule or the plan's schedule is closed now.Check both schedules, in the studio's timezone.
antipassback right after a good entryThe same member just came through this door.Wait out the window or set it to 0.
429 at busy timesThe device hit its per-minute limit.Raise Rate limit on the device (up to 600).
No Show PIN or Check-in QR in the member's portalThe studio has no active door device, or a parent is acting for a dependent.Add and enable a device, or have the member sign in themselves.

Security settings

A few settings keep a stolen key or a flaky network from turning into an open door.

One key per device

Each device gets its own key, shown once and bound to that device. It can only ask door-access questions. Regenerate the key and the old one dies instantly.

IP allowlist

Add your gym's public IP (up to 50 addresses or ranges). A key copied off a device is then useless anywhere else.

Rate limit

60 attempts a minute per device by default, adjustable up to 600 for a busy turnstile bank behind one device.

Fail open, on purpose

A per-device choice that only matters when the device cannot reach Chronix Hub at all. The device then decides by itself. Leave it off unless the door must open in an outage.

No raw secrets, no biometrics

Card numbers are never stored in the clear and logs show the last 4 digits only. Faces are an opaque device id, never a photo or template. One-time PINs and QR passes are short-lived and single use.

Lockouts and alerts

A card that keeps being refused for plan reasons is locked for a while (default: 5 misuse refusals in 10 minutes locks it for 30). Owners and admins get alerts for bursts of refusals and unknown credentials, with at most about 6 emails an hour.

Prefer the story version?

Our blog post walks through turnstiles, readers and kiosks from the studio owner's point of view.

Read: Gym door access control, explained

Frequently asked questions

Does Chronix Hub sell door hardware?

No. Chronix Hub is the software side: it answers "may this person enter?". You bring the turnstile, reader, controller or tablet. Product names belong to their owners and Chronix Hub is not a certified or official partner of any hardware maker.

Which hardware works today?

A web kiosk (any tablet with a browser) and any controller, middleware or script that can make an HTTPS request on every tap. ZKTeco, Hikvision, Suprema and Kisi need a bridge or integration written against the open API. Our ZKTeco bridge is planned, with no release date yet.

What do members need on their phone?

Nothing for a card or face. For a QR pass or a one-time PIN they open the Chronix Hub member portal for your studio and go to My memberships.

Are PINs still saved on a member's profile?

No. PINs are one-time 6-digit codes the member generates in the portal. Each is valid for 5 minutes and works once. Making a new one replaces the previous one.

What happens if the internet goes down?

The device cannot ask Chronix Hub, so it stays shut unless you enabled Fail open for that device. A web kiosk shows a notice and ignores input; nothing is queued, and nobody is let in later. It retries every 10 seconds and recovers by itself.

Do frozen or expired members get in?

No. The check uses the live membership, so the very next tap after a freeze, expiry or cancellation is refused.

Can I limit when members can enter?

Yes, in two places. A door can have a weekly schedule, and each membership plan can have its own. Both must be open at the moment of the tap.

Can I turn people away over unpaid balances?

Optionally. Under Studio Settings, Payments, set a Gate: unpaid balance amount. Members who owe more than it are refused. Leave it empty to ignore balances.

Are face photos stored?

No. The face terminal keeps its own faces. Chronix Hub only stores the terminal's user id for the person, mapped to a member.

Is door access included in my plan?

Door access is a plan feature. If Access Control is missing from your admin sidebar, contact us and we will check your plan.

Want to see door access on your own studio?

Book a short demo and we will walk through your door, your hardware and your membership plans.