Access control in a climbing gym is the mechanism that lets a valid customer in and keeps everyone else out without someone deciding case by case. It's what makes unstaffed hours possible, and unstaffed hours are the cheapest extra capacity most climbing gyms can add: the space already exists, the routes are already set, and the marginal cost of a climber walking in at six in the morning is close to zero.
It's also the part of a gym's system that breaks most visibly. A membership that fails to renew is a support ticket. A door that doesn't open on a Monday at six a.m. is a customer standing in the dark with their phone out — and they'll tell other people about it.
How does access control work in a climbing gym?
Four parts, in this order:
- A credential — an RFID fob, a membership card, a QR code in the customer's app, or a PIN. It says who, not what they're allowed.
- A reader at the door, gate or turnstile. It reads the credential and poses the question.
- A door server (in GymKeeper, the doorserver) that decides the answer: is this credential known, is the card behind it valid right now, and is this card allowed to open this particular door. Then it releases the lock.
- The gym's system, where the cards that decision is made from actually live, and which logs the visit.
The customer's experience is "beep, click, in." Everything interesting happens in step 3, and almost every design decision is really a decision about how much of step 3 lives on the controller and how much lives on the server.
Why that split matters: what happens when the network drops
This is the first question to ask any vendor, and there are three honest answers:
- Fails locked. The controller can't reach the server, so nobody gets in. Safe and simple — and it means your unstaffed hours depend on your internet connection.
- Fails open. The door opens for everyone. Almost never acceptable in a gym with unstaffed hours — you've just given the building away — though it's sometimes used on internal doors.
- Falls back to a local copy. The controller keeps its own up-to-date copy of who's allowed in, and keeps deciding independently until the connection returns, then syncs the visits it logged. This is what unstaffed access requires, and it's why the controller is a small computer and not a relay.
Whichever answer you get: exiting is never an access-control decision. Getting out is governed by local building and fire-safety code, and exit doors have to open from the inside regardless of what any software thinks. Confirm this with your fire inspector, not your software vendor. Worth remembering here: an exit usually leaves no trace in the system at all.
Card validity is the actual product
The hardware is a commodity. The interesting logic is in what "valid right now" means, and this is where a climbing gym differs from an office.
The typical dimensions of validity in a climbing gym:
- Time of day. A standard punch card opens the door 10:00–21:00, a premium card 06:00–23:00, and a full membership 24/7. Selling the same space at different times for different prices is the clearest revenue lever unstaffed access gives you.
- Day of week. Off-peak cards that exclude weekday evenings.
- Date range. A summer card, a three-month student term, a trial week.
- Visits remaining. A ten-visit card that draws down on entry and stops opening the door at zero.
- Competency state. Whether this person has passed a belay test, when the door leads to the rope area.
- Waiver. Whether the record has a signed, valid form at all.
GymKeeper's doorservers evaluate all of this at the moment the credential is presented — including drawing down a punch card's visit on entry, so the card's balance and the door agree without anyone reconciling them.
The design rule is worth stating plainly: the door and the till have to read the same validity from the same record. If a card can be valid at the door and expired at the desk, staff stop trusting either one, and a culture of waving people through takes over, which defeats the whole point.
The problems the brochure doesn't mention
Door-server capability. If the door server only syncs once a day, that's a problem. A membership isn't valid immediately, or a single-visit card isn't usable right away.
Tailgating. One beep, three people walk in. This is the dominant form of shrinkage at unstaffed gyms, and no software fixes it. The options, roughly in price order: signage and culture; a turnstile or speed gate instead of a plain door; a camera at the entrance; and the occasional staffed spot check. Most gyms accept some amount of tailgating and price it in. Deciding that deliberately is better than discovering it in the numbers.
Lost fobs. Budget for a number of them. The fob is cheap; the desk time to issue, register and bill for it isn't. Let the customer app carry the credential wherever you can — a phone goes missing less often than a fob, and gets replaced without a physical handover.
A first-timer at six in the morning. Someone buys a membership online at midnight and shows up before staff do. If your waiver is a paper form at the desk, that person can't legally be in the building. The fix is a digital form that has to be signed before the card becomes valid, so the door itself enforces the rule — see electronic waiver forms.
Shared credentials. Company and family cards are legitimate products, but a credential that's meant to be shared and one that's being shared look identical at the door. If you sell company cards, decide in advance whether they're allowed to open the door during unstaffed hours at all.
Doors aren't the only boundary. Many gyms put a second reader between the public area and the climbing wall, gym floor or sauna. Two cheap readers often beat one expensive argument about the rules.
What to decide before buying hardware
Five decisions, in the order they constrain each other:
- Which hours are unstaffed, and which doors are involved? This determines everything else. Start narrow — a morning window on the main door — and expand once it works.
- Door, turnstile or gate? A turnstile roughly halves tailgating and roughly doubles the installation cost. The floor plan usually decides this for you.
- Which credential? Fob, card, phone or PIN. A phone is cheapest to maintain; a fob is most reliable in a cold entryway with gloves on.
- What does the controller do without the network? See above. If unstaffed hours matter to you, insist on local decision-making.
- Who gets called at six in the morning when it doesn't work? Have this answer before the first unstaffed morning, not after. An emergency PIN with a key person who lives nearby costs nothing and has saved more mornings than any redundancy.
Frequently asked questions
Can access control in a climbing gym run 24/7? Yes, and it's common in bouldering gyms, because no belay partner is required. The constraints are usually insurance, local regulation and your own risk tolerance, not the technology. Talk to your insurer before you talk to a hardware vendor — the answer often shapes which hours you can actually sell.
Does staff need to be on site for climbing to be legal? That depends entirely on the jurisdiction, the insurance, and what kind of climbing happens in the unstaffed area. Bouldering-only spaces are the common case for unstaffed hours. This is a question for your insurer and your local authority, and no software vendor can answer it for you.
Can a ten-visit card open the door? Yes — the controller draws down a visit on entry and refuses once the card is empty. What's worth deciding is what happens on the last visit: many gyms show a message on the reader or send a notification, because a card that quietly runs out turns into a support call at the least convenient time.
How do you stop one membership being shared between two people? Technically, you can't, from the credential alone. What you can do is make it visible: overlapping entries, unusual visit frequency, and visits at a location the member doesn't normally use all show up in the access log. Most gyms handle repeat cases with a conversation, not by cutting the card off.
What does the access log tell you besides security? More than most gyms use it for. Entries by hour tell you when it's worth staffing, when to set new routes, and whether an off-peak product would sell. Visits per member per month is the earliest churn signal you have — a member who stops coming stops paying about two months later.
Related
Access control only works if the card behind the credential is correct, and that's a membership question: see memberships, punch cards and pauses. For where access control sits in the whole picture, see what a climbing gym management system is.
GymKeeper handles access control with its own doorservers: time-limited access, premium cards, punch-card drawdown at the door, and 24/7 access, tied to the same customer record the till and web shop use. The feature list has the details, and get in touch if you'd like to walk through a specific site's floor plan.
Checked: 13 September 2026.