> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cloud-services/smb-security-made-better/gallagher-smb-solution/4-smb-credentials.md). # SMB credentials Understand SMB mobile credentials, Key Tags, cards, User Codes, and two-factor authentication. SMB offers **four credential types**. It is mobile-first, but it supports physical and code-based options as well. ## Mobile credentials Mobile credentials come from Gallagher's **Mobile Connect** credentialing solution. * Using a device the user already has, an administrator **need not order, purchase, or distribute physical access credentials ever again**. * They are provisioned in the SMB app. An admin can invite a user from anywhere, at any time. There is **no limit** to the number of mobile credentials per site. * The user receives an email invite, installs the SMB app, and registers the credential. * iOS talks to the reader via Bluetooth. Android talks to the reader via NFC or Bluetooth. * Credentials are stored securely on the smartphone using the **FIDO** open standard. ### Two-factor authentication (2FA) Two-factor authentication requires something the user *has* (the smartphone) plus something they *know* (a PIN or password) or *are* (a biometric). That second factor must be on the smartphone, not a PIN at the reader. It is designed to prevent an unauthorised user from disarming the site. 2FA is **always required to disarm**. If the area behind the door is **already disarmed**, a user need only present their smartphone like an access card to request access at the door. The smartphone must host the Gallagher SMB app with a **valid mobile credential for the site**. > **Note:** SMB does **not** support 2FA with a mobile credential or card and a PIN at the T30 reader. For 2FA, use the SMB app. ## Key Tags The SMB Key Tag is a **MIFARE DESFire EV2 4K** keyfob. It is overmoulded in PA6 industrial-grade plastic, so it is waterproof and robust, and it is laser-engraved. DESFire EV2 is the highest-security card technology currently available. It is more secure than 125kHz and MIFARE Classic, and it has a better read range than EV1. **Custom encoding.** A Key Tag is encoded using an NFC smartphone running the SMB app, and a privileged user must authenticate first. A site-specific application is stored on the tag, so the tag only works on the site, or credential group, it was encoded for. Multiple layers prevent cloning. ## Cards SMB Cards are the physical credential option alongside Key Tags, on the same DESFire-based encoding model. ## User Codes User Codes are unique codes generated by Site Managers in the SMB app. A Site Manager can generate a code for a user during user creation, or edit an existing user's credential and generate one. * **User Codes can be deleted directly from the SMB app to revoke access if required.** The customer has full control to create and delete User Codes independently, which removes the need to travel to the customer's site to generate new codes or change codes that have been compromised. * They **must be used with the Gallagher T30 Keypad**. * They can be used for access and for arming and disarming. **When a user with disarming privileges enters their User Code at an armed area, the area disarms and access is granted.** * In a credential group, the same user code works across all sites in the group. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cloud-services/smb-security-made-better/gallagher-smb-solution/4-smb-credentials.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.