A smart lock is only as secure as its access list. This guide explains how to create, label, test, review, and remove smart lock access codes and digital keys so residents, guests, contractors, and former occupants have only the access they need—and no more.
Overview
Smart lock access management is an ongoing household task, not a one-time setup step. A permanent PIN created for a housemate, a scheduled code for a cleaner, a mobile key for a family member, and an emergency credential all carry different risks and responsibilities. Treating them as interchangeable can leave old users active longer than intended or make it difficult to determine who unlocked the door.
The exact menu names, code limits, scheduling options, subscription requirements, and emergency procedures vary by lock and app. Use this article as a planning framework, then confirm the details in your lock's current documentation. Before relying on an app-based credential, also check what happens if the phone, internet connection, batteries, or cloud service is unavailable.
A useful access policy follows three principles:
- Least privilege: give each person the narrowest access that meets the need.
- Clear ownership: every code or digital key should have a named user and a reason for existing.
- Reviewability: activity logs and an access register should make it easy to spot stale or unexpected access.
What to track
Choose the right access type
| Access type | Best suited to | Controls to check |
|---|---|---|
| Permanent PIN | Residents or people with an ongoing role | Unique code, named user, activity history, removal process |
| Scheduled code | Cleaners, caregivers, recurring contractors, or regular guests | Start and end dates, days, time window, time-zone settings |
| One-time PIN | A single visit, delivery, inspection, or short emergency need | Expiration behavior, successful-use confirmation, unused-code handling |
| Mobile key | People who need app-based control or notifications | Phone security, invitation status, permissions, lost-device response |
| Auto-unlock | A trusted resident who accepts location-based convenience | Geofence behavior, exclusions, battery impact, and manual override |
| Emergency access | A carefully selected person or fallback procedure | Who holds it, how it is protected, how it is tested, and when it expires |
Do not create a shared household PIN when individual credentials are available. Separate codes make the activity log more useful and allow you to remove one person without disrupting everyone else. Avoid using easily guessed details such as a house number, birth year, or repeated digits. A code should not be written on or near the lock.
Maintain an access-planning worksheet
Keep a private record in a password manager or another protected location. Do not publish actual PINs in a shared note or an unsecured spreadsheet. Track the following fields:
- User name or role, such as “Alex,” “cleaner,” or “property manager”
- Credential type: PIN, scheduled code, one-time PIN, mobile key, or emergency access
- Purpose and doors covered
- Creation date and last review date
- Start date, expiration date, and permitted days or hours
- Whether activity-log access or notifications are enabled
- Last successful test and any failed or unexpected attempts
- Removal date, if the access is no longer required
Record the credential's label even if you do not record the PIN itself. Labels such as “Jordan—resident” or “Plumber—March visit” are more useful than “Code 2.” They help you connect an event in the lock history to a real person or purpose.
Cadence and checkpoints
Set up access deliberately
- List the people and situations that need entry. Separate residents, recurring visitors, one-time visitors, and emergency contacts.
- Choose the least persistent credential. Use a permanent credential only when the relationship is ongoing. Prefer scheduled or one-time access for limited tasks.
- Name the user before activating access. Use a consistent label that identifies the person or role and, where useful, the reason for access.
- Set dates and time windows. Check whether the lock uses local time, whether schedules repeat, and whether an expiration date means the beginning or end of a day.
- Enable activity logs and relevant alerts. Confirm that events identify the credential rather than merely reporting that the lock opened.
- Test the credential while someone is available. Try the code or mobile key from outside, verify that it works only during the intended window, and confirm that the door fully locks afterward.
- Document the result. Add the access record, test date, and planned removal date to your worksheet.
After installation or a major app update, test the complete routine: unlock, open, close, lock, receive the expected notification, and review the activity entry. If the lock has a separate keypad, hub, or bridge, include those components in the test.
Use a recurring review schedule
A monthly review is appropriate for a busy household, short-term rental, or property with frequent contractors. A quarterly review may be sufficient for a stable home. At each checkpoint, compare the access list with the people who actually need entry. Confirm that scheduled credentials still have appropriate dates and hours, remove unused one-time credentials, and check for duplicate or unlabeled entries.
Also review battery status, firmware and app notifications, device-sharing permissions, and the account recovery method. Access control can fail operationally even when the PIN list looks correct—for example, if a resident's phone is lost or the keypad battery is low.
How to interpret changes
Activity logs are most useful when you establish a normal pattern. An unfamiliar event does not automatically prove unauthorized entry: a resident may have used a different credential, an event may reflect a lock or unlock action rather than a door opening, or the device clock may be wrong. Start by matching the timestamp, credential label, door, and household schedule.
Investigate promptly when you see a credential used outside its permitted hours, a former occupant's access after move-out, repeated failed attempts, an unexpected mobile-key invitation, or activity that cannot be associated with a known user. Do not delete the relevant log before documenting what you observed. If the event suggests an active risk, remove or disable the credential, secure the account, and use the lock's documented mechanical or emergency procedure as appropriate.
When a phone is lost, remove its mobile key rather than assuming a screen lock is sufficient. Change or revoke credentials after a household member moves out, a contractor relationship ends, or a shared account is no longer appropriate. If a lock supports remote management, verify the change locally when practical. A remote “removed” status and a successful physical test provide stronger confirmation than either one alone.
Be cautious with auto-unlock. It is convenient but depends on location permissions, phone behavior, app settings, and the lock's interpretation of arrival. Use it only for people who understand the trade-off, and provide a manual method for times when the phone, app, or network behaves unexpectedly.
When to revisit
Revisit your smart lock access list at least monthly or quarterly, depending on how often people change. Perform an immediate audit after any of these events:
- A resident, tenant, or housemate moves in or out
- A cleaner, caregiver, contractor, or property manager finishes work
- A phone containing a mobile key is lost, replaced, or shared
- You reset the lock, change the primary account, or install a new hub
- The app or firmware changes its access menus, scheduling behavior, or notification settings
- The lock shows unexpected activity or repeated failed attempts
- You change the Wi-Fi network, internet service, batteries, or emergency-entry plan
Use this short closing checklist: export or review the activity history if supported; identify every active credential; confirm each user's purpose and expiration; remove former users; test the remaining resident and emergency access; verify notifications; and record the date of the next review. Keep the manufacturer's current emergency-unlock instructions with your household security records, but do not expose emergency credentials in an easily accessible location.
For related access and connected-device planning, see our guide to sharing security camera access safely and the home security system testing checklist. Treat the lock, cameras, sensors, and account permissions as one access-control system: each should have a named owner, a clear purpose, and a scheduled review.
