Gym Access Control: Turnstiles, Cards and App Integration
Practice4 minInnovialabs editorial team
In short
A turnstile should admit a member based on the CRM's answer about membership status, not just because a card exists; the credential (card, QR or face) is chosen by balancing convenience, cost and protection against sharing.
How gym access works
The flow is simple: a member presents a credential (card, wristband, QR code or face), the reader passes it to a controller, the controller asks the system whether entry is allowed and opens the turnstile. The key point is that the CRM makes the decision, not the turnstile. Only the CRM knows whether the membership is active, frozen, valid at this hour and for this zone.
If the turnstile runs on its own card database, separate from the CRM, a member with an expired membership walks right in, and staff find out only at the month-end reconciliation.
Which credential to choose
| Method | Pros | Cons |
|---|---|---|
| RFID card or key fob | Fast, familiar, works without the member's internet | Gets lost, forgotten, easily handed to someone else |
| Wristband | Convenient at the pool and in locker rooms, also opens lockers | Cost of the device, can still be shared |
| QR in an app or bot | No physical device, code can be single-use | Needs a charged phone, scanners can struggle with screen brightness |
| Face recognition | Nothing to forget, nothing to share | Pricier hardware, requires consent to process biometric data |
Many clubs combine methods: a wristband as the main credential and a QR code as a backup when the wristband is left at home.
Linking the turnstile to membership status
On every entry the system should check:
- The membership is active and not frozen.
- Time and day match the plan (for example, a morning-only membership).
- The zone is included: gym floor, pool, spa.
- Remaining visits for a limited package — and deduct one.
- No block is set: debt, rule violation.
When entry is denied, the turnstile stays closed and the front desk sees the reason on screen: "membership expired 3 days ago". A denial becomes a renewal opportunity instead of an argument.
Offline mode. Plan for a lost connection between the controller and the server. Usually the controller keeps a cache of allowed credentials and syncs entries later.
Lockers
Options by level of automation:
- A key on a band — simple, but keys get lost and copied.
- An electronic lock on the same wristband or card — the member opens the locker with the same credential as the turnstile.
- Automatic locker assignment at entry — the system issues a free number and knows who holds it.
A useful link: the exit turnstile does not release a member until their locker is freed, so no lockers stay closed overnight.
Preventing membership sharing
Lending a membership to a friend is direct revenue loss. Ways to prevent it:
- The member's photo on the front desk screen at every entry — cheap and effective.
- Anti-passback: after entering, the same credential cannot be used to enter again until an exit is recorded.
- A dynamic QR code that refreshes every few seconds, so a screenshot will not work.
- Face recognition as the main or a confirming factor.
- Anomaly reports: several entries in a row, entries at different branches within a short time.
How to implement
- Describe plans and access rules in the CRM first — this is the foundation.
- Check that the chosen controllers have a documented API or a ready integration with your CRM.
- Decide where photos and biometrics are stored and collect member consent.
- Launch on one entrance and test denial and offline scenarios.
- Issue credentials to existing members, and only then switch off the old setup.
Common mistakes
- Buying turnstiles before choosing a CRM, then discovering there is no integration.
- Ignoring emergency opening and evacuation: turnstiles must release the passage under safety requirements.
- Storing biometrics without consent or a clear policy.