Unlock with a phone, a card, or a code — and the one safety point we never compromise on.

---

What UniFi Access is

Keys have a problem: you can’t un-issue one. Someone leaves, and either you trust them or you re-key the building.

UniFi Access replaces the key with a credential you can switch off from your phone — a card, a phone tap, a PIN, or a fingerprint. Revoke it in two seconds. See who went through which door and when. Set a door to unlock at 8am and lock at 6pm on its own.

And it runs in the same app as your Wi-Fi and cameras. Same login, same controller. The doorbell rang, here’s the video, here’s who unlocked it, at 14:02.

---

The parts

A door needs a hub and a reader. Not one box — two, at minimum. This is the single most common surprise.

Hubs — the brain of the door

The hub is what actually throws the lock. It’s mounted inside, in the ceiling or a cabinet, where nobody can reach it. This matters: if the thing that opens the door were on the outside wall, prying it off would open the door.

Hub	Power	Doors	Notes
UA-Hub-Door	PoE++ (50W)	One door, in and out	The standard. 5 network ports so readers plug into it. Dry relay 30V/1A, powered relay 12V/1A. $307 all-in — cart-verified ($285 base + $22)
UA-Hub-Door-Mini	PoE++ (50W)	One door	Smaller, 3 ports. Where space is tight.
UA-Hub-Gate	PoE++ (60W)	A gate	Rated −30 to 60°C — the others are 0 to 40°C. Two operator relays plus a side-door lock output. $431 all-in — cart-verified ($400 base + $31)
UA-Retrofit-Hub-2	12/24V DC	One door	For an existing access system. Reuses the wiring and lock already in the door.
EAH-8 (Enterprise Access Hub)	Mains, with lead-acid battery input	Eight doors	8 lock terminals, 4 aux. For a building, not a door.

⚠️ Every hub above needs PoE++ (64W-class), not PoE or PoE+. A 50W hub will not run on a 30W port. Check your switch before you order — see Switches and PoE.

Readers — the bit on the wall

Reader	Power	Notes
UA-G3	PoE (5W)	The standard reader. Card, phone tap, and it’s small. −30 to 45°C.
UA-G3-Flex	PoE (5W)	Adds a keypad — so a PIN works with no card at all. Square. −30 to 60°C — the widest range of the readers, worth knowing for an unheated entry. $301 all-in — cart-verified ($279 base + $22)
UA-G3-Pro	PoE (6W)	Tall reader with a display. Shows names, messages, status. The device gives out −30 to 45°C, but its display only −10 to 45°C. Think hard before putting this on an unheated exterior wall in Calgary.
UA-G3-Fingerprint	PoE (5W)	Fingerprint. No card to lose, no PIN to share.
UA-Reader-Lite	PoE (6W)	Entry-level. −20 to 40°C — the narrowest range here.
UA-Ultra	PoE+ (18W)	Reader and hub in one box. One device, one door. $188 all-in — cart-verified ($175 base + $13). See the warning below.

⚠️ Note on the UA-Ultra: combining the reader and hub is elegant and cheaper — but it means the thing that opens the door is now mounted on the outside wall. That’s a genuine security trade, and it’s the reason the standard design keeps the hub inside. Sometimes it’s the right call. It should be a decision, not a default.

“UA-G3-Entry” does not exist. Verified 2026-07-16. If you’ve seen it in a quote or a blog, it’s an error — the entry-level reader is the UA-G3.

Kits

UA-G3-SK and UA-G3-SK-Pro are starter kits — hub and reader bundled. Convenient. Neither is in our verified price data, so ask and we’ll price them live. And read the “what’s not included” section below first, because a kit doesn’t change that list.

Intercom and the rest

Device	Power	Notes
UA-Intercom	PoE (13W)	The outside unit. Camera, screen, two-way audio. −30 to 60°C.
UA-Intercom-Viewer	PoE (5W)	The inside unit — the screen you answer from. 0 to 40°C, indoor. Sold Out as of 2026-07-16 — Ubiquiti lead time is typically 7–10 days once back in stock. Optional: a door system works without it.
UACC-Chime-PoE	PoE (3W)	Makes a noise when someone’s at the door. Works with Protect doorbells and Access hubs. $105 all-in — cart-verified, $0 surcharge
NFC cards	—	The credential itself. Priced per card, ordered in packs. Not in our verified price data.

On credentials: a card is a thing to lose. A phone is a thing people already guard. We generally recommend phone-based credentials as the primary and cards as the backup — for visitors, for contractors, for anyone who won’t install an app.

---

Fail-secure vs fail-safe — read this properly

Two words. One letter of difference in meaning, and the whole safety conversation lives here.

The question both words answer: what happens to this door when the power goes out?

	Fail-SECURE	Fail-SAFE
Power fails, the door…	stays LOCKED	UNLOCKS
It protects…	the property	the people
Typical use	Offices, suites, stock rooms, side doors	Some stairwells and exits, where an unlocked door is required
Power draw	Only when unlocking — a moment	Constant. It’s electricity holding it shut, all day, forever
Power cut means	The building stays locked	The building is open

Fail-secure = fails to secure. Power dies, it stays shut. Fail-safe = fails to safety. Power dies, it opens.

Neither is the right answer. They’re answers to different questions, on different doors, and a building often has both.

AVNFi’s standard is fail-secure. A power cut shouldn’t unlock a business. The UACC-Lock-Strike-Secure-15mm is a fail-secure strike.

Which brings us to the point of this whole page.

---

⚠️ The safety point: the way OUT must be mechanical

State it plainly, because it’s the one thing on this page that isn’t a preference.

A fail-secure strike stays locked when the power fails. That’s the entire point of it. And it means:

A push bar or a push pad — you shove it, and it retracts the latch through the physical act of pushing. No electricity involved. No signal. No decision made by any device.

Because the failure you’re designing for is all of them at once. Power out. Network down. Hub dead. Building dark. Maybe smoke. Someone who has never been in this building before is walking toward that door, and they will not read a sign, and they will not find a button.

They will push. The door must open when they push.

That’s why an electric release button, a keypad “exit” code, or a “wave to exit” sensor cannot be the only way out. Every one of them is a device. Every device needs power. The scenario you’re designing for is the one where the power is gone.

This is AVNFi’s standard practice

It’s not a line item to trim. It’s the condition on which the whole design is sound.

And this is not legal advice

We are a design-and-install company, not a code authority. What we’ve written above is how we build. It is not a statement of what the law requires of your building.

Egress requirements, hardware requirements, and door assemblies are governed by your local building and fire code, and by your Authority Having Jurisdiction (AHJ). They vary by occupancy type, by building, and by door. Your door contractor, your fire inspector, and your AHJ are the authorities — not us and not this page.

Confirm your requirements with them. We’ll spec the strike and the relay and build to the standard above; we don’t certify doors, and nothing here should be read as saying your door complies with anything.

---

What a reader alone does NOT include

This is where quotes get compared badly. Someone sees “$301 for a reader” and thinks that’s a door. It’s a fraction of one.

A working access-controlled door needs six things:

#	Part	Included with the reader?
1	The reader — the bit on the wall	✅ That’s the one you priced
2	The hub — what actually throws the lock	❌ Separate. UA-Hub-Door is $285
3	The electric strike or lock	❌ Separate. Fail-secure or fail-safe — you’re choosing
4	The wiring — relay cable from hub to lock, network cable to reader	❌ Separate. Labour, and often the biggest line
5	The egress hardware — push bar or push pad	❌ Separate, and usually a door contractor’s work, not ours
6	The credentials — cards or phone passes	❌ Separate. Per person

And frequently a seventh: changing over the existing lock. Your door has a lock in it now. An electric strike goes where the current strike plate is — which sometimes means machining the frame, and on an older or a fire-rated door that’s specialist work.

None of this is upselling. It’s the actual bill of materials for a door that works. A quote that shows only a reader isn’t cheaper — it’s incomplete, and the difference turns up later.

Also easily forgotten: the door position sensor. A small magnetic contact telling the system whether the door is actually shut. Without it, “unlocked at 14:02” is all you know — you don’t know it was propped open with a fire extinguisher until 6pm. Held-open alerts, forced-entry alerts, and any real audit trail all depend on this sensor. It’s inexpensive and it’s the difference between a lock log and a door log.

---

Third-party integration

The relays are generic, and that’s deliberate. A UA-Hub-Door has a dry relay (30V DC, 1A) and a powered relay (12V DC, 1A). A dry relay is just a switch that closes — it doesn’t know or care what’s on the other end.

Which means UniFi Access can trigger things Ubiquiti never made:

• Garage door openers — including Security+ 2.0 models. The hub closes a contact; the opener sees the same signal as a wall button. Your gate and your garage on the same credential as your front door.
• Gate operators — the UA-Hub-Gate has two dedicated operator relays for exactly this.
• Sirens, chimes, existing alarm panels — via the aux relays.
• Existing card systems — the UA-Retrofit-Hub-2 reuses the wiring and lock you already have.

The catch: a dry relay is a possibility, not a guarantee. Whether your specific opener, gate, or panel accepts it depends on that device. It’s usually straightforward. It always needs checking first.

---

Related

• Switches and PoE — every door hub needs PoE++. Check before ordering
• Choosing Cameras — a camera on the door pairs with the log
• Choosing a Gateway — Access runs on the same controller
• Glossary

---

Doors are the part of this trade with the least room for guessing — the hardware, the frame, the egress and the code all have to agree. Door access is Mark’s specialist area, and AVNFi is glad to look at yours.