Any HTTPS-capable device

Chronix Hub exposes one vendor-neutral endpoint. Your device (or the box in front of it) sends the device ID and the credential it just read. Chronix Hub answers with a decision and a reason, and the device opens only on an explicit yes.

Auth is a Bearer device key. Each key belongs to one device and can only ask door-access questions, so a leaked key cannot read member data.

• Access-control platforms and controllers with an HTTP or webhook decision step.
• Middleware or an integrator's custom service sitting between the reader and the lock.
• A small script on a PC or Raspberry Pi next to the reader, with a relay to the lock.
• A face terminal whose middleware can send its own user id for the person.
• Hardware that only speaks its own protocol is not HTTPS-capable on its own. See the ZKTeco, Hikvision, Suprema and Kisi pages.

1. 1

   Create the door and schedule

   Doors tab: name the door, pick a schedule and set anti-passback. See the overview for the details.

2. 2

   Add the device

   Devices tab, Add device. Name it, choose vendor Other (any device that can call a web API), pick the door. Add the gym's public IP to the allowlist.

3. 3

   Copy the key and device ID

   The key is shown once. Store it in the device's secret store, not in a shared document. The device ID (or its exact name) goes in every request.

4. 4

   Make the device POST each tap

   Send the request below to the verify endpoint with the key as a Bearer token. Open the door only when the response is 200 with granted: true.

5. 5

   Send a heartbeat

   Optionally ping the heartbeat endpoint about once a minute so the Devices tab shows Online (heard from in the last 2 minutes).

6. 6

   Test with a real card

   Tap a member's card and watch the Live Log. You should see the attempt and its reason within seconds.

curl -X POST https://api.chronixhub.com/api/v1/access/verify   -H "Authorization: Bearer $CHRONIX_DEVICE_KEY"   -H "Content-Type: application/json"   -d '{
    "deviceId": "Front turnstile",
    "credential": { "type": "card", "value": "0012345678" }
  }'

HTTP 200
{
  "granted": true,
  "reason": "active_membership",
  "memberId": "clx...",
  "memberName": "Sara Haddad",
  "expiresAt": "2026-12-31T23:59:59.000Z",
  "displayMessage": "Welcome, Sara"
}

HTTP 200
{
  "granted": false,
  "reason": "membership_frozen",
  "displayMessage": "Membership is frozen"
}

Credential types

Send exactly one credential per request.

curl -X POST https://api.chronixhub.com/api/v1/access/heartbeat   -H "Authorization: Bearer $CHRONIX_DEVICE_KEY"   -H "Content-Type: application/json"   -d '{ "deviceId": "Front turnstile", "firmwareVersion": "1.4.2" }'

HTTP 200
{ "ok": true, "serverTime": "2026-10-21T08:30:00.000Z" }

// Open the door ONLY on an explicit yes. Everything else is "no".
const res = await fetch("https://api.chronixhub.com/api/v1/access/verify", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CHRONIX_DEVICE_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ deviceId, credential: { type, value } }),
});
const open = res.status === 200 && (await res.json()).granted === true;
if (open) unlockDoor();

Rules your integration must follow

• Only HTTP 200 with granted: true opens the door. Treat every other status and every timeout as a no.
• Every decision, including a refusal, is a 200. Non-200 means a problem with the request or key: 400, 401, 403, 404, 429 or 5xx.
• Never put the key in a query string or a URL. Use the Authorization header.
• Show displayMessage on the device's screen if it has one. It is short and safe to show.
• A denied PIN never includes a member name, so do not expect one.
• Respect 429 by waiting before you retry. The default limit is 60 attempts a minute per device.
• Fail open is a setting for when the device cannot reach Chronix Hub at all. A server error is never permission to open.

• Can the controller or middleware make an HTTPS POST with a Bearer token for each access attempt and open on the response?
• Can it send a card number, a typed code, a face terminal's user id and a scanned QR as the credential value?
• Will it treat every error, timeout and non-200 as a refusal?
• Can it send a heartbeat every minute or so?
• Where will the device key be stored, and who can read it?
• What is the gym's public IP, so we can add it to the allowlist?