Access and keys

Parklio has several ways to let someone other than you operate a product: a guest, an employee, your own app, a vehicle. They differ in who receives them, whether they work offline, whether Parklio emails anyone, and how fast you can revoke them. This page compares them so you can pick one.

Where access comes from

When a product is paired with the Connect app, it gets a master key, a secret shared by the product and Parklio. Every credential below is derived from it, and the product checks them itself over Bluetooth, which is why some of them work without a network. You never handle the master key. Pairing a product again, or removing it from its lot, invalidates every credential derived from the old one.

Comparison

Mechanism	Who gets it	What they need	Reaches the product via	Works offline	Revocation	Parklio emails	Plan feature
Operation token	Your backend, which passes it to your app	Your app, built with the Parklio SDK	The phone, over Bluetooth	✅	Not immediate: see below	No	—
Operation key	A Parklio Connect user, by email	The Connect app	The phone, over Bluetooth	✅	Block it through its key log	Only an invitation, when the email has no account yet	KEY_SHARE
Key invitation	An email address with no Parklio account	To sign up for the Connect app	Becomes an operation key on sign-up	—	Block it before it's accepted	Yes, the invitation	KEY_SHARE
Weblink	An email recipient	A browser	The cloud and a Gateway	❌	Immediate	Yes, always	—
QR code	Whoever holds the image				Can't be revoked	No	QR_CODE_SHARE
License plate	A vehicle	Nothing	An LPR camera, the cloud and a Gateway	❌	Delete or expire the whitelist entry, or unbind the plate	No	—

Two paths are built for integrations and have full guides: operation tokens for your own app, and license plates for vehicles. The others are covered by the API reference.

Operation tokens

For your own mobile app. Your backend creates a token for one product and a time window with POST /v2/operation-tokens, and hands it to your app, which uses the Parklio SDK to operate the product over Bluetooth.

• Give either an end_time or "is_unlimited": true. Unlimited tokens are valid until 2038-01-01.
• The response contains three signed commands: token_open, token_close and token_status. Your app passes them to the product through the SDK.
• Revocation isn't immediate. Blocking a token (PATCH /v2/operation-tokens/{id} with {"status": "blocked"}) marks it blocked on the server, but nothing is pushed to the device, so a copy your app already holds can keep working until end_time. Create tokens just in time, with short windows.
• The product's clock must be set (rtcc_invalid is 0), or time-limited credentials fail.

See SDK.

Operation keys and key invitations

For people who use the Parklio Connect app. Create one with POST /v2/operation-keys, naming the receiver by email:

• If the email belongs to a Connect user, they get an operation key in their app.
• If not, Parklio emails them a key invitation. When they sign up for the Connect app with that email, it becomes an operation key.

To revoke an operation key, block its key log (PATCH /v2/key-logs/{id}); Parklio emails the receiver. Block a pending invitation with PATCH /v2/key-invitations/{id}.

Weblinks

A link Parklio emails to the receiver; opening it in a browser lets them operate the product through the cloud and a Gateway. Create one with POST /v2/weblinks: start_time and end_time are both required, and max_uses defaults to 1 (null for unlimited). Revocation is immediate, because the server checks every use. Parklio always sends the email; you can't send the link through your own channel.

QR codes

An image that grants opening for a time window. Create one with POST /v2/qr-codes. A QR code can't be revoked: deleting it only removes the record, so give it the shortest window that works.

License plates

Vehicles whose plate is whitelisted on a lot can be let in by an LPR camera:

1. Whitelist the plate on the lot with POST /v2/lot-whitelists, for a time window or unlimited.
2. Bind it to the products it should open with POST /v2/products/{id}/bind-licenses, using the license_id from step 1.
3. When a camera in the zone reads the plate on entry, Parklio opens a bound product that's online and closed, through a Gateway.

Each read is recorded as a plate reading, with an access_decision (triggered or denied) and the reason.

See Plate-based access.

Next

• Operation tokens for your app
• Plate-based access
• SDK: the operation-token flow end to end.
• Plans and permissions: the features each mechanism needs.