Mobile keys and digital check-in: how keyless entry works in a hotel

What a mobile key is and what it replaces

A mobile key (also called a virtual or digital key) is a digital credential, such as a QR code, a Bluetooth key in an app or a credential in a digital wallet, that opens the room's electronic lock without a magnetic card or a physical key. The lock system, integrated with the PMS, generates this credential automatically as soon as check-in is confirmed, and it is sent to the guest by email, WhatsApp or within the hotel's app, working straight from the phone at the room door. These technologies do not all behave the same way: security and the need for a connection at the moment of opening depend on the architecture chosen.

In practice, it replaces two well-known points of friction: the magnetic stripe card, which demagnetises, gets lost and can be cloned with a cheap stripe reader; and the manual step of encoding a key at the desk, which holds up the whole front desk queue when the hotel's system slows down at peak times.

Digital check-in: from the pre-check-in link to the key on the phone

A complete digital check-in usually follows four steps: the guest receives a link before arrival (by email or WhatsApp) to fill in their details, complete the payment steps that apply to the booking and accept the terms of stay; the system validates the identity document, often with a photo and, in some cases, facial recognition; the PMS releases the room and, through the integration with the lock system, the mobile key is generated automatically; and the guest receives the key on their own phone, without needing to go to the front desk.

This does not eliminate the hotel's front desk. Guests without a prior check-in, payment problems and any non-standard situation still need human service. The real gain is taking out of the queue the people who sorted everything out before arriving, freeing the front desk team for those who need it. The flow also needs to provide for guests who cannot or do not want to use their phone, including for accessibility reasons.

The integration that decides whether the project works: lock, PMS and mobile key

A frequent mistake in keyless entry projects is buying the electronic lock before confirming the integration with the PMS. A lock compatible with Bluetooth or NFC is of no use for mobile keys if the manufacturer does not have an integration already certified with the hotel's management system: without it, generating the key becomes a parallel manual process, which cancels out the main benefit of digital check-in.

Before signing a contract with any digital lock supplier, it is worth confirming three points: whether there is a native, certified integration with the hotel's current PMS (not a "generic compatibility" promised in a sales meeting); whether the mobile key expires automatically at check-out time, without depending on manual action by the team; and whether every opening of the lock is recorded in a log, linked to the credential used, so that any incident can be investigated.

Before going live, test the complete flow, not just the happy path: booking, pre-check-in, submission to the FNRH, payment, room assignment, key generation, room entry, room move, stay extension, early check-out, cancellation and key revocation. These deviations are where integrations tend to fail.

WhatsApp as a channel for check-in and guest communication

In Brazil, WhatsApp is usually a more convenient channel for digital check-in than a dedicated app the guest has to download. Using the WhatsApp Business Platform (the official API) integrated with the PMS, the hotel can send the pre-check-in link, receive the document confirmation, notify the guest when the room is ready and deliver the mobile key, all in the same channel the guest already uses every day.

The technical point to watch is to use the official API, with the account, the access credentials and the integration protected, instead of informal automations running on a personal phone. Besides the risk of the account being blocked, this kind of shortcut usually does not integrate with the PMS or produce the audit trail the hotel needs to keep.

Security: what changes when the key is a QR code or Bluetooth

A well-implemented mobile key can be more secure than a magnetic stripe card, but that depends on the technology and integration chosen. In general, it expires automatically at check-out, cannot be cloned by reading a stripe, and every opening is recorded with the date, time and credential used. This helps both to protect the guest and to give the hotel an auditable history in case of any dispute or incident.

The comparison does not only apply to magnetic stripes. Many hotels already use RFID cards, but older generations, such as MIFARE Classic, have had their encryption broken for years and can also be copied with affordable equipment. If the hotel uses RFID, it is worth asking the lock supplier which technology is in the card before concluding that the problem does not apply.

The nature of the risk changes: instead of physical cloning, the point to watch becomes the security of the app (how the key is stored on the guest's phone) and of the network that connects the lock to the PMS. That is why electronic locks and the hotel's other IoT devices should sit on an infrastructure network separate from the guest network, and not on the same Wi-Fi network open to the public, as we set out in the guide to Wi-Fi network segmentation.

Key life cycle and staff access

Generating the key is the easy part. The system also needs to revoke and reissue it, without depending on a risky manual adjustment, when the booking is cancelled, the guest leaves early, moves room, extends the stay or loses their phone.

The same logic applies to staff. Housekeeping, maintenance, security and management need different credentials, with permissions and hours suited to each role. Credentials for people who leave the hotel should be revoked the same day, and temporary access, such as for an outsourced technician, should be recorded.

What if the internet goes down?

A mobile key should not be assessed only on how it works normally. The answer to a failure depends on the architecture: some locks validate locally a credential already delivered to the phone, without needing a connection at the moment of opening; others depend on a cloud service. And issuing new keys generally depends on the PMS and the supplier's platform.

Before the purchase, test at least these scenarios: internet down, PMS unavailable, lock supplier's service unavailable, a power cut or the lock battery running out, the guest's phone battery dead and a guest without a smartphone. For each one, the front desk needs a route that does not depend on a single technology, such as a physical contingency card or opening by staff, and maintenance needs to be alerted before the battery runs out. The procedure should be part of the hotel's IT contingency plan.

LGPD and FNRH in digital check-in

Digitising check-in does not eliminate the FNRH (Ficha Nacional de Registro de Hóspedes, Brazil's national guest registration form). Since 20 April 2026, the form is submitted exclusively through the Ministry of Tourism's digital FNRH platform, usually through integration with the PMS. The hotel's check-in platform is not necessarily the digital FNRH: the hotel can use a commercial pre-check-in and mobile key solution, but needs to confirm how the data the FNRH requires reaches the official platform and who answers for each step of that integration.

Because digital check-in usually includes a photo of the identity document and, in some flows, facial recognition, it must follow the same principles as any other processing of personal data under the LGPD (Brazil's data protection law), a subject we cover in the LGPD guide for hotels: minimal collection, a defined retention period and a contract with the platform supplier that correctly defines its role in the processing (usually a processor, but that depends on what it does with the data) and each party's responsibilities.

Facial recognition calls for extra care. Biometric data is sensitive personal data (LGPD, art. 5, II), and processing it must rest on one of the legal bases in art. 11, such as specific and prominent consent or fraud prevention in identification and authentication processes, as well as respecting necessity, transparency and security. Before putting the flow into production, the hotel should assess whether biometrics are necessary, which legal basis applies, how long the data is kept and who has access. As good practice, it is worth offering an alternative without biometrics, such as checking the document at the front desk, and preparing a data protection impact assessment (RIPD, the Brazilian equivalent of a DPIA). The legal basis should be validated with the hotel's legal advisers.

Before investing: questions for the supplier

• Does the integration with our PMS already exist and is it certified, or would it be developed on demand?
• Does the mobile key expire automatically at check-out, without depending on manual action by the front desk?
• Does every opening of the lock generate an auditable log, linked to the credential used?
• How is the key revoked when there is a cancellation, early check-out, room move or lost phone?
• How are the credentials for the front desk, housekeeping, maintenance and temporary technicians created and revoked?
• How does the check-in data reach the digital FNRH, and who answers if the submission fails?
• Does the WhatsApp communication use the WhatsApp Business Platform (the official API)?
• Does the contract define the supplier's role in processing the check-in data and each party's responsibilities?
• What happens to the guest's access if the internet, the PMS or the supplier's service goes down at the moment of check-in or of opening the door?
• What happens to the lock when the power fails or the battery runs out, and how is maintenance alerted beforehand?
• Is there a form of emergency access that does not depend on the guest's phone?

Next steps

Mobile keys and digital check-in reduce queues, modernise the guest experience and, when well implemented, can increase security compared with the magnetic stripe card. The risk lies in buying the lock before validating the integration with the PMS, or implementing the flow without the contingency, LGPD and network precautions. Our team assesses the integration before the purchase and follows the implementation. Talk to our team.

Sources

• Ministry of Tourism, FNRH Digital: perguntas frequentes (FAQ, in Portuguese), gov.br/turismo
• Ministry of Tourism, Portaria MTur nº 41, que institui a FNRH em meio digital (the ordinance establishing the digital FNRH, November 2025, in Portuguese), gov.br/turismo
• Brazil, Lei nº 13.709/2018 (LGPD), arts. 5 and 11 (in Portuguese), planalto.gov.br