​

UniFi Access Integration

​

Overview

UniFi Access is Ubiquiti’s enterprise door access control system that integrates with the broader UniFi IT management ecosystem. The Nexudus integration with UniFi Access automates credential provisioning and access policy assignments based on customer contracts, passes, bookings, and desk assignments.

​

Key Features

• On-premises management: Deployed on your local network using UniFi infrastructure
• Network Bridge connectivity: Secure communication through Nexudus Bridge (no port forwarding required)
• Automatic provisioning: Access policies granted and revoked based on plan changes, bookings, and pass assignments
• Multi-credential support: NFC cards, PIN codes, and mobile app access (UniFi Identity)
• Policy-based permissions: Map your inventory (passes, resources, desks) to UniFi Access policies
• Booking-based temporary access: Automatic access during reservation windows for booking holders and guests
• Check-in session tracking: Maintains access during check-in sessions based on active time passes
• Team billing support: Members of team billing groups receive access to all team resources
• Shared passes: Team members automatically receive access from shared time passes
• Mobile app support: Optional UniFi Identity app integration for smartphone-based door unlock

​

Integration Type

On-premise with Network Bridge — UniFi Access requires UniFi infrastructure (Dream Machine Pro, UniFi Cloud Key, or UniFi OS Console) at your location. Nexudus connects via the UniFi Access API using the Nexudus Network Bridge at https://bridge.nexudus.com/{device_id}/.

​

Capabilities

​

How It Works

​

Access Control Model

UniFi Access uses an access policy-based model to manage permissions:

• Users represent individuals in the system (mapped to Nexudus customers)
• Access Policies define collections of doors and resources that users can access
• Credentials include NFC cards, PIN codes, and mobile app identities
• Doors are individual access points managed by door controllers
• Resources are doors, floors, or zones controlled by the access system

When a customer’s access needs change in Nexudus (e.g., they purchase a pass, book a resource, check in, or their contract renews), the integration automatically updates their user record in UniFi Access with the appropriate access policy assignments.

​

Access Calculation

The integration evaluates multiple sources to determine a customer’s access:

1. Active Time Passes: All passes currently valid for the customer
2. Shared Passes: Passes shared by paying member in team billing arrangements
3. Check-in Sessions: Active check-ins maintain pass-based access for session duration
4. Upcoming Bookings: Resources booked by customer (access granted 15 minutes early)
5. Booking Guest Access: Resources where customer is added as a guest
6. Contract Desks: Desks included in active contracts
7. Team Billing Desks: Desks from paying member’s contracts for team members

All access policies from these sources are aggregated and applied to the customer’s UniFi Access user record.

​

Multi-Door Support

UniFi Access uses access policies to grant permissions to multiple doors and resources. Instead of mapping each door individually:

1. In UniFi Access, create an access policy (e.g., “Coworking Space Access”, “Meeting Room Access”)
2. Add the relevant doors and resources to that policy in UniFi Access
3. In Nexudus, select that access policy from the dropdown when mapping your pass/resource/desk
4. Customers with that pass automatically get access to all doors and resources in the policy

​

Prerequisites

Before connecting Nexudus to UniFi Access, ensure you have:

1. UniFi Access system deployed with administrator access:
   • UniFi Dream Machine Pro, Cloud Key, or UniFi OS Console
   • UniFi Access application installed and configured
   • At least one UniFi Access Hub connected
   • Door controllers and readers installed and online
2. API credentials created in UniFi Access:
   • Local user account with API access permissions
   • API key generated for the user account
3. Network Bridge installed and configured:
   • Nexudus Network Bridge agent running on your local network
   • Bridge device ID registered in your Nexudus dashboard
   • Bridge configured to forward requests to your UniFi Access API endpoint
4. UniFi Access configured with:
   • Access policies created for different access levels (e.g., “Full Access”, “Meeting Rooms Only”)
   • Door controllers provisioned and online
   • Readers associated with doors
5. Nexudus location configured with:
   • Plans, passes, and resources defined
   • Customers enrolled

​

Configuration

​

Step 1: Set Up the Network Bridge

The UniFi Access integration requires the Nexudus Network Bridge to securely connect your on-premises UniFi infrastructure to Nexudus.

1. Download and install the Network Bridge agent on a computer in your location’s network
2. When the agent starts, it will display a unique Device ID
3. Copy this Device ID — you’ll need it for both the bridge configuration and the UniFi Access integration settings
4. In Nexudus, go to Settings → Devices and click Register Device
5. Enter the Device ID to register the bridge
6. Configure the bridge to point to your UniFi Access API endpoint (typically https://[controller-ip]:12445)
7. Save the configuration and verify the bridge shows as “Connected”

​

Step 2: Enable and Connect to UniFi Access

1. In the Nexudus dashboard, go to Settings > Integrations
2. Find UniFi Access in the list and expand the settings
3. Enable the Enabled toggle
4. Enter your connection details (fields appear when toggle is enabled):
   • API Key: Your UniFi Access API key (generated in UniFi Access console)
   • Bridge Device ID: The device ID from your Network Bridge installation (from Step 1)
5. Click Save to establish the connection
6. Once connected successfully, the configuration panels for passes, resources, and desks will load below

​

Step 3: Configure Optional Features

After enabling the integration, configure optional features based on your needs:

​

PIN Code Synchronization

Enable Set PIN based on customer Pincode if you want Nexudus to synchronize customer PIN codes to UniFi Access:

• When enabled, the first 4 digits of the customer’s Access Pincode field are synced to UniFi Access
• Customers can then use their PIN to unlock doors (if your UniFi Access readers support PIN entry)
• PINs are updated automatically when changed in the customer’s Nexudus profile
• If a customer’s pincode is shorter than 4 digits or empty, their UniFi Access PIN is cleared

​

UniFi Identity Mobile App

Enable Send UniFi Identity invite email to new customers to automatically invite customers to use the UniFi Identity mobile app:

• When enabled, new users created in UniFi Access receive an email invitation to download the UniFi Identity app
• Customers can then use their smartphone to unlock doors without physical credentials
• The invitation includes instructions for downloading the app and completing setup
• This feature requires the UniFi Identity service to be enabled in your UniFi Access system

​

Step 4: Map Passes to Access Policies

Passes are the primary way customers receive access in Nexudus. Each pass can be mapped to one or more UniFi Access policies.

1. In the Passes section, you’ll see all passes configured for this location
2. For each pass, select one or more UniFi Access policies from the dropdown menu
   • The dropdown shows all access policies available in your connected UniFi Access system
   • Policies are automatically retrieved when you save the connection settings
   • You can select multiple policies for a single pass
3. Leave blank if a pass should not grant physical access

How it works:

• When a customer has an active contract on a plan that includes passes, they automatically receive those passes
• If the pass is mapped to UniFi Access policies, the customer is granted access to those policies
• When the pass expires or is consumed, access is revoked
• Time-limited passes (e.g., day passes with validity windows) automatically grant and revoke access at the appropriate times

Example mapping:

​

Step 5: Map Resources to Access Policies

Resources (meeting rooms, event spaces, etc.) can require specific access permissions for bookings.

1. In the Resources section, you’ll see all resources configured for this location
2. For each resource, select one or more UniFi Access policies from the dropdown menu
3. Leave blank if resource bookings should not grant physical access

How it works:

• When a customer books a resource, Nexudus grants them access 15 minutes before the booking starts
• Access is automatically revoked when the booking ends
• If the booking is cancelled, access is removed immediately
• Booking guests also receive access to the resource’s policies during the booking window

Example mapping:

​

Step 6: Map Desks/Units to Access Policies

Floor plan desks and units can grant access to specific areas when included in a customer’s contract.

1. In the Desks/Units section, you’ll see all desks from your floor plans
2. For each desk, select one or more UniFi Access policies from the dropdown menu
3. Leave blank if desk assignments should not grant physical access

How it works:

• When a desk is added to a customer’s contract, they receive access to the mapped policies
• Access is granted when the contract starts and revoked when it ends
• Team billing support: If a customer uses team billing (merged billing), they also receive access to desks included in the paying member’s contracts

Example mapping:

​

Step 7: Save Configuration

1. Review all mappings to ensure they’re correct
2. Verify policy names match exactly with your UniFi Access system
3. Click Save to apply the configuration
4. Nexudus will immediately start provisioning access for customers based on the new mappings

​

How Access is Managed

​

When Access is Granted

Nexudus automatically grants UniFi Access permissions when:

1. Contract starts: Customer begins a contract on a plan → receives passes included in that plan → assigned to corresponding UniFi Access policies
2. Pass activated: Customer receives a pass directly (not via a contract) → assigned to the mapped UniFi Access policies
3. Check-in created: Customer checks in with a time pass → maintains access to pass policies for the duration of the check-in session
4. Booking created: Customer books a resource → granted access to resource’s policies 15 minutes before booking start time
5. Booking guest added: Customer is added as a guest on a booking → granted access to resource’s policies during the booking window
6. Desk added to contract: Desk is added to an active contract → customer receives access to the desk’s mapped policies
7. Team member access: Paying member’s team receives access to all policies from paying member’s passes and desks
8. Shared passes: Team members receive access from shared passes of their paying member

​

When Access is Revoked

Nexudus automatically revokes UniFi Access permissions when:

1. Contract ends or cancelled: Customer loses passes from that contract → removed from corresponding UniFi Access policies
2. Pass expires: Pass validity ends or usage is consumed → removed from mapped UniFi Access policies
3. Check-in ends: Customer checks out or check-in session expires → pass-based access is re-evaluated
4. Booking ends or cancelled: Booking time expires or is cancelled → access to resource’s policies is removed
5. Booking guest removed: Customer is removed as a guest from a booking → access to resource’s policies is revoked
6. Desk removed from contract: Desk is removed from contract → access to desk’s policies is revoked
7. Customer deactivated: Customer account is deactivated → all UniFi Access permissions removed

​

Access Update Timing

• Immediate updates: Contract changes, pass assignments, and customer deactivations trigger access updates within seconds
• Booking lead time: Booking access is granted 15 minutes before the booking start time
• Background processing: Access updates are queued in background jobs to handle high volumes efficiently
• Distributed locking: Prevents concurrent updates to the same customer across multiple servers
• Debouncing: 5-second debounce prevents rapid repeated updates for the same customer
• Automatic retries: Failed updates are automatically retried with exponential backoff

​

Credential Management

UniFi Access supports multiple credential types that customers can use to unlock doors. You can configure which types are enabled for your integration.

​

NFC Cards

To assign NFC access cards to customers:

1. Go to Operations > Customers
2. Select the customer
3. In their profile, enter card IDs in the Access Card ID field
4. Separate multiple cards with commas: 1234567890,0987654321,1122334455
5. Save the customer profile

Card behavior:

• No card: User exists in UniFi Access but cannot unlock doors with a physical card
• Card assigned: Customer can use NFC card to unlock doors
• Card removed: Physical access via that card is revoked (user remains in system)
• Multiple cards: Customer can have multiple cards assigned simultaneously

Card format:

• Card IDs must match the format used by your UniFi Access system
• Common formats include: Facility Code + Card Number, or raw card number
• Cards can be identified by their Display ID or Alias in UniFi Access
• The integration searches for matching cards by both fields

​

PIN Codes

If you enable Set PIN based on customer Pincode, customers can unlock doors using a PIN:

1. Go to Operations > Customers
2. Select the customer
3. Enter a PIN in the Access Pincode field (at least 4 digits)
4. Save the customer profile

PIN behavior:

• Only the first 4 digits are synchronized to UniFi Access
• PINs are updated automatically when changed in Nexudus
• If the pincode is shorter than 4 digits or cleared, the UniFi Access PIN is removed
• PINs only work if your door readers support PIN entry

​

Mobile App (UniFi Identity)

If you enable Send UniFi Identity invite email, customers can use the UniFi Identity mobile app:

1. When a new user is created in UniFi Access, they automatically receive an email invitation
2. The customer downloads the UniFi Identity app (iOS/Android)
3. They follow the setup instructions in the invitation email
4. Once configured, they can unlock doors using their smartphone via Bluetooth or QR code

Mobile app requirements:

• UniFi Identity service must be enabled in your UniFi Access system
• Email settings must be configured in UniFi Access
• Customers need a smartphone with Bluetooth or camera (for QR code)
• Readers must support Bluetooth or QR code unlock

​

Remote Door Unlock

Customers can unlock doors remotely through the Nexudus Members Passport App without needing to be physically present at the door.

​

How It Works

1. Customer logs in to the Members Portal (web or mobile app)
2. Views available doors - Only doors they have permission to access are shown
3. Selects a door and taps “Unlock”
4. Door unlocks immediately - The system triggers the UniFi Access door controller to unlock
5. Confirmation displayed - Customer sees success or error message

​

Requirements

• Customer must have active access permissions to the door (via passes, bookings, or desk assignments)
• Customer must be logged in to the Members Portal
• The door must be online and reachable by UniFi Access controllers
• Network Bridge must be running and connected

​

Access Verification

Before unlocking a door, the system verifies:

• The customer has at least one access policy that grants access to the requested door
• The customer’s account is active
• The door exists in the customer’s list of accessible doors

If verification fails, the unlock request is denied with an “Access Denied” message.

​

Use Cases

• Letting in deliveries: Customer can unlock the front door for a delivery person without leaving their desk
• Early arrival: Customer can unlock doors before physically arriving at the space
• Remote assistance: Staff can help customers who are locked out by unlocking doors remotely
• Guest access: Customer can unlock doors for guests they’re expecting

​

Troubleshooting

​

Monitoring Integration Errors

Nexudus monitors your access control integration and alerts you to any issues that need attention.

​

Business Checkup Dashboard

Access control integration errors are displayed on the Business Checkup page:

1. Go to Home > Important Items in the dashboard, or
2. Navigate directly to dashboard.nexudus.com/dashboards/checkup
3. Look for the Access Control Integration tile
4. If there are errors, the tile will be displayed in red

​

What Gets Flagged

• Authentication failures: Invalid API key or connection errors
• Provisioning errors: Failed attempts to create or update customer access
• Configuration issues: Missing or invalid policy mappings
• Network connectivity: Connection timeouts or unreachable bridge
• API errors: Errors returned by the UniFi Access API

Each error includes:

• The customer affected
• The nature of the problem
• When the error occurred
• Suggested actions to resolve it

​

Security Considerations

​

Data Shared with UniFi Access

When provisioning access, Nexudus shares the following information with UniFi Access:

• Customer data: First name, last name, email address
• Employee number: Nexudus customer ID (stored in the Employee Number field for reference)
• NFC cards: Card tokens from the Access Card ID field (assigned to user)
• PIN codes: First 4 digits of Access Pincode (if PIN sync enabled)

Nexudus does not share:

• Phone numbers
• Billing information
• Payment details
• Contract specifics (only policy assignments)
• Personal notes or custom fields

​

Network Security

• HTTPS encryption: All communication uses HTTPS (SSL/TLS)
• Bearer token authentication: Secure API authentication using API keys
• On-premises control: Your UniFi Access system remains on your local network
• Network Bridge security: All traffic is encrypted through secure tunnel with no inbound firewall ports required
• No port forwarding: Unlike direct API access, the Network Bridge eliminates the need for exposing your network

​

Credential Management

• NFC cards: Managed in both Nexudus and UniFi Access; always assign through Nexudus
• PIN codes: Synced from Nexudus to UniFi Access when feature is enabled
• Mobile app: Provisioned by UniFi Access after Nexudus creates the user
• Credential isolation: Customers can only access doors permitted by their assigned policies
• Automatic deactivation: Credentials become inactive when customer account is deactivated

​

Privacy Considerations

• Customer data is only sent to your on-premises UniFi Access system (not to external services)
• Access logs remain in your UniFi Access system under your control
• Mobile app invitations are sent by your UniFi Access system using your SMTP settings
• No customer data is shared with Ubiquiti cloud services without your explicit configuration

​

Best Practices

​

Policy Organization

• Create granular policies: Use separate policies for different access levels (24/7 vs business hours, full access vs meeting rooms only)
• Use descriptive names: Name policies clearly (e.g., “24/7 Full Building”, “Business Hours Meeting Rooms”)
• Test before production: Create test passes and verify door access before rolling out to customers
• Document mappings: Keep a record of which passes/resources map to which policies

​

Credential Management

• Prefer mobile app: Enable UniFi Identity invites for a better customer experience (no physical cards to manage)
• Use consistent card IDs: Establish a standard format for entering card IDs (Display ID vs Alias)
• PIN codes for convenience: Enable PIN sync for customers who need quick access without carrying cards
• Multiple credentials: Assign both card and PIN as backup options

​

Access Policy Design

• Group similar permissions: Create policies that group doors customers need together (avoid creating a policy per door)
• Separate by time: Use different policies for 24/7 access vs business hours (managed in UniFi Access policy schedules)
• Balance security and convenience: Don’t grant more access than necessary, but avoid creating too many complex policies

​

Booking Access

• 15-minute buffer: Remember that booking access starts 15 minutes early — consider this when booking back-to-back resources
• Clear policy naming: Make it obvious which resources require which access (helps when troubleshooting)
• Test guest access: Verify booking guests receive proper access during their booking windows

​

Team Billing

• Consistent desk policies: Ensure all desks used by a team have the same access policies
• Test paying member access: Verify team members receive all access from the paying member’s passes and desks
• Document team access: Make it clear in your plans which desks/passes grant which access

​

Monitoring

• Check Business Checkup regularly: Review integration errors at least weekly
• Test new configurations: When adding new passes/resources, test with a test customer first
• Monitor UniFi Access logs: Check UniFi Access audit logs for denied access attempts
• Keep bridge running: Ensure the Network Bridge agent runs as a Windows service for reliability

​

Additional Resources

• Network Bridge Documentation — Learn more about the Nexudus Network Bridge
• Access Control Overview — Understand how access control works in Nexudus
• UniFi Access Documentation — Official Ubiquiti UniFi Access documentation
• Business Checkup Dashboard — Monitor integration health