.png)
.png)
A hotel room key reaches a guest’s phone as a credential provisioned into the device, then presented to the door reader over NFC. On iPhone and Apple Watch it is stored in the Secure Element, the tamper-resistant chip inside the device. On Android, host card emulation delivers the same experience.
How does a digital room key work?
A credential is placed in the guest’s phone before they arrive, and the phone presents it to the door reader over NFC, the short-range radio behind every tap.
Apple documents the sequence for access keys plainly. The device downloads an Access credential, which Apple calls an applet, and installs it in the Secure Element. It then provisions that credential with the data it needs, including keys, configuration settings, access rights, and the access document itself, received from the access partner’s servers. At the door, the reader communicates with the credential in the Secure Element through the NFC controller over an established secure channel.
Apple SE TSM is the PayCloud module for that path. A Trusted Service Manager, or TSM, is the authorized party that places credentials into a device’s secure element and manages them across their life, which is what the sequence above requires somebody to do.
Android works differently and reaches the same guest experience. Android HCE uses host card emulation, the method Android uses to let a phone act as a contactless card, with the credential held in software and its keys replenished from the cloud rather than kept in a dedicated chip. Two mechanisms, one outcome, and a guest who should never need to know which one applies to them.
Worth being clear about one thing, because hotel projects stall on it more than on anything else. None of this works without readers at the doors that can speak to a phone. The credential is the half of the problem that moves quickly. The lock estate is the half that sets the schedule.
Is a phone key secure?
On iPhone the key lives in the Secure Element, and Apple states that credentials stored there cannot be extracted or leak.
Apple’s platform security documentation is specific about this. Access keys in Apple Wallet are stored inside the Secure Element of supported devices, which hosts applets designed so that the keys they manage cannot be pulled out. Apple also states that when or where a person uses a key in Apple Wallet is never shared with Apple or stored on Apple servers. Separately, Face ID, Touch ID, or a passcode is required before pass information including hotel booking details is displayed.
Set that against a plastic keycard. A magnetic stripe card carries its credential in a form that can be read and copied with inexpensive equipment, it works for anyone holding it, and the usual recovery procedure when a guest loses one is to issue another and hope the first is not found by someone else. The phone key is a meaningful improvement on a low bar, and saying so does not require overstating it.
The industry is also standardizing, which matters for anyone writing a specification this year. In February 2026 the Connectivity Standards Alliance released Aliro 1.0, an open specification for digital keys that uses asymmetric cryptography to establish trusted interactions between a user’s device and a reader while protecting privacy. Apple, Google, Samsung, HID, Allegion, and a number of lock and silicon manufacturers were named among the first to certify, and over 220 member companies contributed to it.
One honest caveat on that. The Alliance describes Aliro as a living standard with further phases planned, which is a reasonable thing for a specification released this year to say and an important thing for a hotel to hear before writing it into a procurement document. A published standard and a standard running in your property are different stages, and the gap between them is measured in lock replacement cycles.
What changes for the guest?
The front desk stops being a required stop, which is the change guests notice and the one they tell other people about.
The key can be in the phone before arrival, so a guest landing at eleven at night walks to the room. It cannot be left in the room, because the phone is the thing nobody leaves behind. It cannot be demagnetized by sitting next to a credit card. And Apple supports sharing an access key with another person, with the key owner choosing both the access level and the valid time period, which handles the second guest in the room without a second trip to the desk.
At checkout it expires. No plastic to return, no card to cut up, no key quietly working for the next three weeks because nobody reprogrammed the lock.
What changes for the hotel?
The relationship stays with the brand, and that is the part worth more than the operational savings.
A guest who reaches their room using a credential that carries your name has interacted with your brand at the single most-remembered moment of a stay. A guest who does it through a third party’s app has interacted with that third party. Both guests slept in your room. Only one of them experienced it as yours.
Loyalty connects to this, though it is worth being precise about how. Card-linked loyalty attaches rewards to the payment credential, so a guest paying at the bar, the restaurant, or the spa is credited from that transaction without presenting anything extra. Loyalty Exchange runs that points ledger on the same platform as the payment. That is recognition across the stay, earned through what the guest was already doing.
The operational case is real but secondary. No plastic to buy, no cards to reprogram between stays, and access that can be revoked immediately rather than at the next housekeeping round.
What should a hotel decide first?
Audit the locks before anything else, because the lock estate determines what is possible and when.
A property whose readers already support phone credentials is having a software conversation. A property whose locks predate that capability is having a capital conversation, with a replacement cycle that will set the launch date regardless of how quickly everything else moves. Knowing which of those you are is a week of work and it changes every number in the plan.
The second decision is scope across the estate. One flagship property is a different project from a portfolio, and the portfolio version is not the flagship version repeated. It involves lock vendors who do not all move at the same speed, and that variation is the thing that turns a confident timeline into an apologetic one.
Where to go next
Apple SE TSM, Android HCE, and Loyalty Exchange are part of PayCloud Provision™, built on Provision-Once Architecture™. A credential is provisioned once and managed through every change that follows, across payments, access, identity, and loyalty.
Explore Apple SE TSM for hospitality.
See premium hospitality use cases.
Related: How can credit unions become the first card members reach for?
Provisioned once. Trusted everywhere. One secure infrastructure for payments, access, identity, and loyalty.
Frequently asked questions
How does a digital room key work?
A credential is provisioned into the guest’s phone before arrival and presented to the door reader over NFC. On iPhone and Apple Watch the credential is installed in the Secure Element and the reader communicates with it through the NFC controller over a secure channel. On Android, host card emulation delivers the same experience in software.
Is a hotel key in a phone secure?
Apple states that access keys in Apple Wallet are stored in the Secure Element, whose applets are designed so keys cannot be extracted or leak, and that where and when a key is used is never shared with Apple or stored on Apple servers. Biometric or passcode authentication is required before booking details are shown.
What is Aliro and does it affect hotels?
Aliro is an open digital key specification released by the Connectivity Standards Alliance in February 2026, using asymmetric cryptography between a device and a reader. Apple, Google, Samsung, and major lock manufacturers were named among the first to certify. The Alliance describes it as a living standard, so hotels should confirm what their own lock vendor supports today.
What is a Trusted Service Manager?
A Trusted Service Manager, or TSM, is the authorized party that places credentials into a device’s secure element and manages them across their life. PayCloud’s Apple SE TSM module is built for that role on iPhone and Apple Watch.
What usually determines the timeline for a mobile key project?
The lock estate, not the phone. A property with readers that already support phone credentials is running a software project. A property whose locks predate that capability faces a replacement cycle that sets the launch date regardless of how quickly the rest of the work moves.
Sources
Apple. Access using Apple Wallet, Apple Platform Security (accessed October 2026).
.svg){kind=icon}