​

Paxton NET2 Access Control Integration

​

Overview

​

Key Features

• On-premises management: Dedicated server installed at your location
• OAuth2-based authentication: Secure API authentication using Resource Owner Password Credentials flow
• Automatic provisioning: Access is granted and revoked automatically based on plan changes, bookings, and pass assignments
• RFID token support: Multiple RFID tokens per customer with customizable token types
• Area-based permissions: Map your inventory (passes, resources, desks) to Paxton NET2 areas
• Booking-based temporary access: Automatic access during reservation windows for booking holders and guests
• Check-in session tracking: Maintains access during check-in sessions based on active time passes
• Team billing support: Members of team billing groups receive access to all team resources
• Shared passes: Team members automatically receive access from shared time passes
• Timezone support: Configure access permissions with specific timezone restrictions

​

Integration Type

• Network Bridge: Secure tunnel through https://bridge.nexudus.com/{device_id}/ (recommended)
• Port Forwarding: Direct connection to https://public_ip:8443/ (requires firewall configuration)

​

Capabilities

​

How It Works

​

Access Control Model

• Users represent individuals in the system (mapped to Nexudus customers)
• Areas define collections of doors that users can access
• Tokens are physical RFID cards assigned to users
• Doors are individual access points managed by door controllers
• Timezones define when access is permitted (e.g., 24/7, business hours only)

​

Access Calculation

1. Active Time Passes: All passes currently valid for the customer
2. Shared Passes: Passes shared by paying member in team billing arrangements
3. Check-in Sessions: Active check-ins maintain pass-based access for session duration
4. Upcoming Bookings: Resources booked by customer (access granted 15 minutes early)
5. Booking Guest Access: Resources where customer is added as a guest
6. Contract Desks: Desks included in active contracts
7. Team Billing Desks: Desks from paying member’s contracts for team members

​

Multi-Door Support

1. In Paxton NET2, create an area (e.g., “Coworking Space Access”)
2. Add the relevant doors to that area in Paxton NET2
3. In Nexudus, select that area from the dropdown when mapping your pass/resource/desk
4. Customers with that pass automatically get access to all doors in the area

​

Prerequisites

1. Paxton NET2 system installed on-premise with administrator access
2. Local API enabled via the NET2 Local API Configuration Utility
3. Nexudus license file installed for API access (provided by Nexudus support)
4. API credentials (username and password for API authentication)
5. Network connectivity — Either:
   • Network Bridge configured: Device ID from your Nexudus Network Bridge installation
   • Port forwarding configured: Public IP address with port 8443 (or custom port) forwarded to your Paxton NET2 server
6. Paxton NET2 configured with door controllers installed and online
7. Areas created in Paxton NET2 for different access levels (e.g., 24/7 access, business hours only)
8. Timezones configured in Paxton NET2 for when access should be granted
9. Nexudus location configured with plans, passes, and resources

​

Configuration

​

Step 1: Enable and Connect to Paxton NET2

1. In the Nexudus dashboard, go to Settings > Integrations
2. Find Paxton Net2 in the list and expand the settings
3. Enable the Enable Paxton Net2 integration toggle
4. Enter your connection details (fields appear when toggle is enabled):
   • Paxton Net2 server address: Choose one of the following:
     • Network Bridge: https://bridge.nexudus.com/{DEVICE_ID}/ (replace {DEVICE_ID} with your Bridge device ID)
     • Port Forwarding: https://YOUR_PUBLIC_IP:8443/ (replace YOUR_PUBLIC_IP with your public IP address and port)
   • Paxton Net2 username: Your Paxton NET2 API username
   • Paxton Net2 password: Your Paxton NET2 API password
   • Paxton Net2 Client ID: Use 8bea7086-c5bb-4d71-98ca-a81be791e82b (fixed Nexudus identifier)
   • Token Type (optional): The token type for RFID cards (defaults to “Unspecified”)
5. Click Save to establish the connection
6. Once connected successfully, the configuration panels for passes, resources, and desks will load below

​

Step 2: Map Passes to Areas

1. In the Passes section, you’ll see all passes configured for this location
2. For each pass, select one or more Paxton NET2 areas from the dropdown menu
   • The dropdown shows all areas available in your connected Paxton NET2 system
   • Areas are automatically retrieved when you save the connection settings
   • You can select multiple areas for a single pass
3. Leave blank if a pass should not grant physical access

• When a customer has an active contract on a plan that includes passes, they automatically receive those passes
• If the pass is mapped to Paxton NET2 areas, the customer is granted access to those areas
• When the pass expires or is consumed, access is revoked
• Time-limited passes (e.g., day passes with validity windows) automatically grant and revoke access at the appropriate times

​

Step 3: Map Resources to Areas

1. In the Resources section, you’ll see all resources configured for this location
2. For each resource, select one or more Paxton NET2 areas from the dropdown menu
3. Leave blank if resource bookings should not grant physical access

• When a customer books a resource, Nexudus grants them access 15 minutes before the booking starts
• Access is automatically revoked when the booking ends
• If the booking is cancelled, access is removed immediately

​

Step 4: Map Desks/Units to Areas

1. In the Desks/Units section, you’ll see all desks from your floor plans
2. For each desk, select one or more Paxton NET2 areas from the dropdown menu
3. Leave blank if desk assignments should not grant physical access

• When a desk is added to a customer’s contract, they receive access to the mapped areas
• Access is granted when the contract starts and revoked when it ends
• Team billing support: If a customer uses team billing (merged billing), they also receive access to desks included in the paying member’s contracts

​

Step 5: Save Configuration

1. Review all mappings to ensure they’re correct
2. Verify area names match exactly with your Paxton NET2 system
3. Click Save to apply the configuration
4. Nexudus will immediately start provisioning access for customers based on the new mappings

​

How Access is Managed

​

When Access is Granted

1. Contract starts: Customer begins a contract on a plan → receives passes included in that plan → assigned to corresponding Paxton NET2 areas
2. Pass activated: Customer receives a pass directly (not via a contract) → assigned to the mapped Paxton NET2 areas
3. Check-in created: Customer checks in with a time pass → maintains access to pass areas for the duration of the check-in session
4. Booking created: Customer books a resource → granted access to resource’s areas 15 minutes before booking start time
5. Booking guest added: Customer is added as a guest on a booking → granted access to resource’s areas during the booking window
6. Desk added to contract: Desk is added to an active contract → customer receives access to the desk’s mapped areas
7. Team member access: Paying member’s team receives access to all areas from paying member’s passes and desks
8. Shared passes: Team members receive access from shared passes of their paying member

​

When Access is Revoked

1. Contract ends or cancelled: Customer loses passes from that contract → removed from corresponding Paxton NET2 areas
2. Pass expires: Pass validity ends or usage is consumed → removed from mapped Paxton NET2 areas
3. Check-in ends: Customer checks out or check-in session expires → pass-based access is re-evaluated
4. Booking ends or cancelled: Booking time expires or is cancelled → access to resource’s areas is removed
5. Booking guest removed: Customer is removed as a guest from a booking → access to resource’s areas is revoked
6. Desk removed from contract: Desk is removed from contract → access to desk’s areas is revoked
7. Customer deactivated: Customer account is deactivated → all Paxton NET2 access removed

​

Access Update Timing

• Immediate updates: Contract changes, pass assignments, and customer deactivations trigger access updates within seconds
• Booking lead time: Booking access is granted 15 minutes before the booking start time
• Background processing: Access updates are queued in background jobs to handle high volumes efficiently
• Distributed locking: Prevents concurrent updates to the same customer across multiple servers
• Debouncing: 5-second debounce prevents rapid repeated updates for the same customer

​

RFID Token Management

1. Go to Operations > Customers
2. Select the customer
3. In their profile, enter token IDs in the Access Card ID field
4. Separate multiple tokens with commas: 123456,789012,345678
5. Save the customer profile

• No token: User exists in Paxton NET2 but cannot unlock doors (no physical credentials)
• Token assigned: Customer can use physical RFID token to unlock doors
• Token removed: Physical access is revoked (user remains in system)
• Multiple tokens: Customer can have multiple tokens assigned simultaneously

• Token Type: Configurable in integration settings (defaults to “Unspecified”)
• Tokens are automatically created/updated/deleted based on the Access Card ID field
• Token IDs should match the format expected by your Paxton NET2 system
• Each token is associated with the customer’s user record in Paxton NET2

​

Timezone Configuration

• Timezone ID: Configured in the integration settings (defaults to timezone 1)
• Timezones are created in Paxton NET2 (e.g., “24/7 Access”, “Business Hours Only”, “Weekend Access”)
• When customers are assigned to areas, they receive the configured timezone for those permissions
• Different areas can have different timezone restrictions

• Timezone 1: Typically configured as 24/7 access
• Timezone 2: Business hours only (e.g., Monday-Friday 8 AM - 6 PM)
• Timezone 3: Extended hours (e.g., Monday-Sunday 6 AM - 11 PM)

​

Troubleshooting

​

Monitoring Integration Errors

​

Business Checkup Dashboard

1. Go to Home > Important Items in the dashboard, or
2. Navigate directly to dashboard.nexudus.com/dashboards/checkup
3. Look for the Access Control Integration tile
4. If there are errors, the tile will be displayed in red

​

What Gets Flagged

• Authentication failures: Invalid credentials or connection errors
• Provisioning errors: Failed attempts to create or update customer access
• Configuration issues: Missing or invalid area mappings
• Network connectivity: Connection timeouts or unreachable server
• API errors: Errors returned by the Paxton NET2 API

• The customer affected
• The nature of the problem
• When the error occurred
• Suggested actions to resolve it

​

Security Considerations

​

Data Shared with Paxton NET2

• Customer data: First name, last name
• External ID: Nexudus customer ID stored in the FAX field (used to link records between systems)
• RFID tokens: Token IDs from the Access Card ID field
• Token type: Token type from integration settings

• Email addresses
• Phone numbers
• Billing information
• Payment details
• Contract specifics (only area assignments)
• Personal notes or custom fields

​

Network Security

• HTTPS encryption: All communication uses HTTPS (SSL/TLS)
• OAuth2 authentication: Resource Owner Password Credentials flow with access tokens
• On-premises control: Your Paxton NET2 system remains on your local network
• Bridge security: If using Network Bridge, all traffic is encrypted through secure tunnel (no inbound ports)
• Port forwarding security: If using port forwarding, restrict firewall rules to Nexudus IP addresses only

​

Credential Management

• Physical tokens: Managed in both Nexudus and Paxton NET2; always assign through Nexudus
• User passwords: Never shared with Nexudus; authentication is handled by Paxton NET2
• API credentials: Stored securely in Nexudus; transmitted over HTTPS only

​

Related Documentation

• Access Control Overview
• Network Bridge Setup - For on-premises connectivity without opening firewall ports
• Passes Configuration
• Plans & Contracts
• Resource Bookings
• Check-ins

​

Best Practices

​

Area Organization

• ✅ Good: “24/7Access”, “BusinessHours”, “MeetingRooms”, “PrivateOffices”
• ❌ Avoid: “HotDeskPlan”, “DedicatedDeskPlan” (these are billing products, not access types)

​

Naming Conventions

• Create descriptive area names in Paxton NET2 that make them easy to identify in the dropdown
• Avoid overly long area names that are difficult to read in the admin panel
• Document area-to-door mappings in Paxton NET2 for future reference
• Use consistent naming across different access control zones

​

Token Management

• Assign unique token IDs to each customer
• Keep spare tokens for emergencies
• Regularly audit token assignments and deactivate unused tokens
• Use the correct Token Type for your RFID card system
• Test new tokens immediately after assignment

​

Timezone Configuration

• Configure timezones in Paxton NET2 before mapping areas in Nexudus
• Use timezone 1 for 24/7 access (most common)
• Create separate timezones for business hours, extended hours, and weekends
• Document which timezone ID corresponds to which access schedule
• Test timezone restrictions to ensure they work as expected

​

Network Connectivity

• No firewall configuration required
• Secure outbound connection to Nexudus
• Easy setup and maintenance
• See Network Bridge documentation for installation

• Configure firewall to forward port 8443 (or custom port) to Paxton NET2 server
• Restrict access to Nexudus IP addresses only
• Ensure valid SSL certificates for production use
• Use static IP or DNS for consistent connectivity

​

Technical Details

{
  "AccessLevels": [],
  "IndividualPermissions": [
    {
      "Id": 123,
      "TimezoneId": 1
    }
  ]
}