Case Study · IoT · Access Control

IoT-Driven Secure Access
for businesses

One cloud platform for every door that matters: office buildings, gym floors, cafe staff rooms, and lifts. People unlock with a personal PIN, NFC tap, or phone — and Super Admin plus Company Admin watch it live.

The product is a React console for three roles, a Go backend, and MQTT from a hardware door controller on ESP32 / ESP32-S3. Each opening is a kit: ESP32 panel, PN532 or Wiegand reader, lock, contact, and request-to-exit. That board publishes unlocks, denials, and door state — Super Admin does not poll the pad.

ESP32 door controller App unlock MQTT publish

Access hardware Controller publishes

Person unlocking a glass office door on a smart PIN keypad

PIN accepted

Logged to cloud

Controller online

Door event in under a second

ESP32-S3 hardware door controller · PIN · NFC · App

ESP32 · Go · MQTT

3 panels Super Admin · Company · User

4 zones Building · Gym · Cafe · Lift

ESP32-S3 Hardware door controller · MQTT

PIN + app Personal codes, not shared keys

The problem in detail

Four door types. Four spreadsheets. Zero live view.

Facility teams were running building lobbies, gym gates, cafe staff doors, and lift floors as separate systems. Physical keys sat in a drawer. One PIN was written on a sticky note behind the espresso machine. Gym members shared the same four-digit code. When someone left the company, nobody knew which doors they could still open.

No single identityAccess was tied to metal keys and shared codes — not to a staff member, member, or visitor record.
No live monitoringAdmins found out about a forced door or an after-hours gym entry the next morning, if at all.
No user door listPeople did not know which doors they were allowed to use. Reception became the helpdesk.

Close-up of a smart door PIN keypad showing Access Granted

How a person gets in

PIN, tap, or app — same door, same audit

Every method still checks schedule, zone, and role in the Go policy engine. The React apps only show what that role is allowed to do.

Personal PIN

Each user gets a unique code — not a shared gym PIN. Wrong attempts lock the pad. Company Admin can rotate a PIN without touching hardware.

Person at a smart glass door using contactless access

NFC badge or phone

Tap the reader for contactless entry at lobby, gym, cafe, or lift. The event still appears on Super Admin and Company Admin live feeds.

Phone held in a lobby beside a wall PIN reader

User door list + unlock

The user panel lists only assigned doors. One tap unlocks if they are in range, or they walk to the pad and enter PIN for cafe staff rooms.

Hardware at the door

Named kit: ESP32 hardware door controller

The MQTT client is an ESP32-S3 (or ESP32-WROOM-32 on two-door cafe staff rooms). Field devices hang off that board. Readers and locks do not talk to the cloud on their own.

Hardware door controller · ESP32-S3

Espressif ESP32-S3 (Wi-Fi + BLE) as the 2/4-door panel in the comms closet. GPIO relays for the lock, Wiegand/OSDP from the reader, TLS MQTT client that publishes every event. Cafe two-door sites use ESP32-WROOM-32.

ESP32-S3 · ESP32-WROOM-32

RFID / NFC · PN532 + Wiegand

NXP PN532 (13.56 MHz NFC / phone tap) on the unsecure side, plus a 125 kHz Wiegand RFID reader for badges. The ESP32 only receives the UID — it does not open the lock until Go (or local cache) says yes.

PN532 · Wiegand 26-bit

PIN keypad · 4×4 matrix

Membrane 4×4 keypad on cafe staff doors and after-hours gym gates, read by the ESP32 GPIO. Wrong PINs lock the pad; the ESP32 still publishes the denial on MQTT.

4×4 keypad

12V maglock / electric strike

Fail-secure 12V electric strike on office doors; 12V electromagnetic lock on glass gym and lobby leaves. An opto-isolated relay on the ESP32 is what actually unlocks — not the phone app.

12V lock · relay

Door contact · MC-38

MC-38 magnetic reed on the frame, wired into ESP32 GPIO. Closed vs held-open vs forced. Super Admin alerts are from this sensor, not from a camera guess.

MC-38 DPS

REX · PIR HC-SR501

HC-SR501 PIR or a push-to-exit button on the secure side so people can leave without a PIN. ESP32 publishes REX so a free exit is not logged as a forced door.

HC-SR501

PSU · 12V / 5V

12V for maglock and strike, 5V for the ESP32. On mains loss the ESP32 publishes POWER_FAIL and stays up on a small backup long enough to keep the gym gate honest.

12V / 5V PSU

App as a credential

My Doors unlock is not a Bluetooth lock. The phone hits the Go API; Go publishes a command the ESP32 subscribes to, then the same relay the PIN pad uses fires. The ESP32 still publishes the event.

ESP32 /cmd

Where the readers sit

Real spaces. Different rules.

The same IoT reader firmware is installed in four environments. Policy — not hardware — decides who can open which door and when.

Building

Office building lobby & floors

Main glass entrance, tenant floors, and server rooms. Staff PIN or badge for office hours. Visitors get a time-boxed lobby code from Company Admin. Super Admin sees every building’s reader health on one map.

Real commercial gym interior with treadmills and access control at the door

Gym

Gym floor & member gate

Members unlock during paid hours only. Trainers keep after-hours access. When a membership expires, the user door list drops Gym Floor 2 immediately — no more shared four-digit code on the glass.

Cafe

Cafe staff room & store

Public cafe stays open. The staff door next to the bar uses PIN so only rostered baristas open stock and cash rooms. Company Admin assigns shift windows; failed PINs show as alerts on the live feed.

Lift

Lift floors & call permissions

The reader beside the lift bank only enables the floors on that person’s door list. Executive floors stay hidden. Every call is logged with user, time, and destination for Super Admin audits.

Three React panels

Live monitoring for operators. A door list for users.

Switch roles. Super Admin watches the whole estate. Company Admin runs one business. Users only see the doors they can open.

Platform operator

Super Admin — live estate monitoring

This is the control tower. Super Admin onboards companies, sees every ESP32 hardware door controller (building, gym, cafe, lift), and can emergency-lock a site. They do not manage a single employee’s gym hours — that stays with Company Admin.

Live feed from controller MQTT publishes
Device health: panel, lock, DPS, PIN errors
Global policy, firmware, and audit export

React dashboard · MQTT from ESP32-S3 · Go event stream.

OmniAccess · Super Admin Live MQTT

48Companies

312Doors online

14PIN unlocks / hr

2Alerts

Time	Zone	Event	Status
10:24:31	Gym	CTRL-04 PUB ACCESS_GRANTED	Granted
10:24:18	Cafe	CTRL-09 PUB DPS closed	OK
10:23:47	Lift	CTRL-02 PUB REX	Exit
10:22:30	Building	CTRL-12 PUB ACCESS_DENIED	Denied

Live Original HD console — not a third-party screenshot

Operations desk with Super Admin monitoring console on a wide display — NOC / security desk view Always-on monitoring

Facility & HR

Company Admin — people, PINs, and doors

Day-to-day operators for one business. They assign staff to Building + Lift, members to Gym, baristas to Cafe staff door, and watch who entered in the last hour. They never see another company’s data.

Issue or rotate personal PIN codes
Zone schedules: gym hours, cafe shifts, visitor lobby
Live “who just opened which door” feed

If a PIN is shared, revoke it here. User door list updates instantly.

Tower A · Company Admin Live

86People

24Doors

9PIN rotations

1Visitor expiring

Person	Zone	Method	Status
Asha Rao	Lobby + Lift 12–18	App	Active
Mark Kim	Gym 06:00–22:00	PIN	Active
Nora Lee	Cafe staff	PIN	Shift
Visitor · NL	Lobby only	PIN	Expires 18:00

Live Original HD company console

Facility manager workspace Staff, PIN, last unlock

Staff & members

User — My Doors list

Users never see other companies or global health. They open the app and get a clear list: which doors they can use, whether the reader is online, and whether this door needs an in-app unlock or a PIN at the pad.

Only assigned doors: lobby, gym, cafe, lift, office
Unlock nearby, or walk to PIN pad for staff rooms
Personal history: today’s lobby and lift times

Good morning, Asha

My Doors

5 doors assigned to you

Lobby · Tower A Building · Online

Unlock

Gym Floor 2 Gym · 06:00–22:00

Unlock

Cafe Staff Use PIN at the pad

Lift Floor 14 Lift · Allowed

Call

Office 4F Scheduled 08:00–19:00

Wait

User at a lobby PIN reader with the access app on their phone — At the door App list + wall PIN

What happens in one second

From PIN to open door and live log

Present

User enters PIN on the pad, taps NFC, or taps Unlock on their door list while standing at the reader.

Authorize

The ESP32-S3 hardware door controller publishes the PIN, NFC UID, or app command over MQTT. Go checks identity, zone, schedule, and whether the code is still valid.

Unlock

The ESP32 fires the 12V strike or maglock, or enables the lift floor. The pad shows Access Granted.

Monitor

The same event appears on Super Admin and Company Admin live feeds, and in the user’s history.

What the ESP32 publishes

ESP32-S3 hardware door controller as an MQTT publisher

Each ESP32-S3 (or ESP32-WROOM-32) is a client on the broker. It publishes door events and health. It subscribes only for commands (unlock, lock, schedule sync). Consoles never talk to the maglock directly.

Publish topics (ESP32 → broker)

access/{site}/{ctrl}/eventGranted, denied, REX, forced, held-open
access/{site}/{ctrl}/healthOnline, tamper, power, battery
access/{site}/{ctrl}/lockStrike/maglock state after a relay change
access/{site}/{ctrl}/dpsDoor contact: closed, open, held

Subscribe (broker → ESP32)

access/{site}/{ctrl}/cmdUnlock, lock, PIN cache, firmware

CTRL-04 · ESP32-S3 · gym-front Publishing

PUB  access/tower-a/ctrl-04/event     qos 1
{
  "ts": "2026-09-19T10:24:31Z",
  "hw": "ESP32-S3",
  "controllerId": "CTRL-04",
  "doorId": "gym-front",
  "event": "ACCESS_GRANTED",
  "method": "PIN",
  "userId": "u_asha",
  "lock": "UNLOCKED"
}

PUB  access/tower-a/ctrl-04/dps       qos 1
{ "hw": "ESP32-S3", "doorId": "gym-front", "sensor": "MC-38", "state": "OPEN" }

PUB  access/tower-a/ctrl-12/event     qos 1
{
  "ts": "2026-09-19T10:22:30Z",
  "hw": "ESP32-WROOM-32",
  "controllerId": "CTRL-12",
  "doorId": "lobby",
  "event": "ACCESS_DENIED",
  "method": "PIN",
  "reason": "UNKNOWN_PIN"
}

PUB  access/tower-a/ctrl-04/health    qos 0 retained
{ "hw": "ESP32-S3", "online": true, "tamper": false, "mains": true }

Live ESP32-S3 publishes — Go API and React boards subscribe

Technology

React for every panel. ESP32-S3 publishes MQTT.

Super Admin, Company Admin, and the user door list are React applications. The Go API owns authentication, PIN hashing, policy, and /cmd unlocks. Field hardware is named: ESP32-S3 / ESP32-WROOM-32 as the hardware door controller, PN532 NFC, Wiegand RFID, 4×4 PIN keypad, 12V maglock or strike, MC-38 door contact, and HC-SR501 REX.

The ESP32 publishes events even if nobody has the app open. When Company Admin opens live monitoring, the feed is already on the broker.

React JS Go API MQTT ESP32-S3 ESP32-WROOM-32 PN532 MC-38 HC-SR501

React JS consoles

Live dashboards subscribe to controller topics. Super Admin and Company Admin never poll the pad.

Go backend

Policy engine, PIN lifecycle, and MQTT commands back to the controller relay.

MQTT — ESP32 publishes

ACCESS_GRANTED, ACCESS_DENIED, REX, DOOR_FORCED, DPS, health. Broker fans those out to the live boards.

ESP32 hardware door controller

ESP32-S3 / ESP32-WROOM-32 · PN532 · Wiegand RFID · 4×4 keypad · 12V maglock · MC-38 · HC-SR501 — building, gym, cafe, and lift.

Outcomes

What changed after go-live

Personal PINs, not sticky notes

Cafe and gym codes stopped being shared. Each person has a PIN Company Admin can rotate without a site visit.

Live, not next-day logs

Super Admin and Company Admin see unlocks as they happen — including failed PIN attempts on staff doors.

Users know their doors

The My Doors list ended reception guesswork. If Gym is not on the list, the gate will not open.

Build yours

Need this for your building, gym, or cafe?

We map Super Admin monitoring, Company Admin PIN and people ops, a user door list, and an ESP32-S3 hardware door controller (MQTT publish) onto a React and Go platform your teams can run.

Start a conversation Back to portfolio

IoT-Driven Secure Access for businesses

Four door types. Four spreadsheets. Zero live view.

PIN, tap, or app — same door, same audit

Personal PIN

NFC badge or phone

User door list + unlock

Named kit: ESP32 hardware door controller

Hardware door controller · ESP32-S3

RFID / NFC · PN532 + Wiegand

PIN keypad · 4×4 matrix

12V maglock / electric strike

Door contact · MC-38

REX · PIR HC-SR501

PSU · 12V / 5V

App as a credential

Real spaces. Different rules.

Office building lobby & floors

Gym floor & member gate

Cafe staff room & store

Lift floors & call permissions

Live monitoring for operators. A door list for users.

Super Admin — live estate monitoring

Company Admin — people, PINs, and doors

User — My Doors list

My Doors

From PIN to open door and live log

Present

Authorize

Unlock

Monitor

ESP32-S3 hardware door controller as an MQTT publisher

Publish topics (ESP32 → broker)

Subscribe (broker → ESP32)

React for every panel. ESP32-S3 publishes MQTT.

What changed after go-live

Personal PINs, not sticky notes

Live, not next-day logs

Users know their doors

Need this for your building, gym, or cafe?

IoT-Driven Secure Access
for businesses