Add-on: Paxton Net2

The Paxton Net2 Add-on connects Storeganise to your on-premise Paxton Net2 access control system, automating door access throughout the entire customer lifecycle. When a customer moves in, their Paxton user account is created and access is granted automatically. When they move out or fall overdue on payments, access is revoked immediately — no manual intervention required.Because Paxton Net2 runs on your local network rather than in the cloud, the Add-on uses a secure ngrok tunnel to bridge Storeganise to your on-premise Net2 server. This tunnel is set up once during installation and runs continuously in the background.

Before you start

Before configuring the Add-on, make sure you have the following ready:

A Paxton Net2 system installed and running at your facility
Doors and timezones already configured in Paxton Net2 — these cannot be created via the API
An ngrok account with a tunnel configured to expose your Net2 server (see Setting up ngrok below)
Your Paxton API credentials: username, password, and client ID (your Paxton licence key)

How access works

The Add-on uses a two-level access structure that mirrors how Paxton Net2 is designed:

Shared facility access — Access points that all customers at a site can use, such as the main gate, lobby door, or elevator. These are configured once at the site level.
Individual unit access — The door for a customer's specific storage unit. Each customer is granted a personal door permission for their own unit only.

Customers access the facility using a PIN code. This PIN is generated automatically when they move in and stored on their unit rental, where it is also visible to the customer in the Customer Portal.If Net2 only controls your gates and shared doors and your units use padlocks, turn on Facility access only so customers only get your shared access points (see Facility access only (gate-only sites) below).

Fobs and key cardsThe Paxton Net2 Add-on supports fobs and key cards as access credentials. When a customer moves in, the Add-on automatically generates and assigns a PIN to their Net2 user account. If you also want the customer to access the facility using a fob or key card, you can assign one to their user account directly in the Paxton Net2 dashboard. Fob and key card enrolment is handled entirely within Paxton Net2 and has no effect on Storeganise. Nothing will appear or change on the unit rentalWhen a customer moves out or is locked out due to an overdue payment, the Add-on revokes their door permissions at the user level. This removes access for all credential types associated with that user — including any fobs or key cards enrolled in Net2 — so no separate action is needed.

Setting up ngrok for Paxton Net2

Storeganise runs in the cloud; your Paxton Net2 server runs on your local network. To allow Storeganise to communicate with it, your Net2 server needs to be made publicly accessible via a secure tunnel. ngrok is the tool that creates this tunnel.

Note: ngrok is a third-party service with its own pricing. Plans start at approximately $8/month for a single site or $20/month for multiple sites. See current pricing at ngrok.com/pricing.

Create an ngrok account

Go to ngrok.com and create an account.
After signing in, go to Your Authtoken in the ngrok dashboard.
Copy your authtoken — you will need it in the next step.

Install and configure the ngrok agent

Important: The ngrok agent must be installed on the same Windows machine that is running your Paxton Net2 server. It will not work if installed on a different machine.

Download the ngrok agent from the ngrok download page.
Install the agent on the Windows machine running your Paxton Net2 server.
Open a command prompt and run the following to authenticate:

ngrok config add-authtoken YOUR_AUTHTOKEN

Start ngrok to expose your Net2 server. The default Net2 port is 8443 :

ngrok http https://localhost:8443

ngrok will display a public HTTPS URL — for example, https://abc123.ngrok-free.app . Copy this URL; you will need it when configuring the Add-on.

Important: On free ngrok plans, this URL changes every time you restart the ngrok agent. If your URL changes, you must update the Paxton URL field in your Add-on settings immediately — otherwise the Add-on will lose connection to your Net2 server. To avoid this, upgrade to a paid ngrok plan with a reserved domain.

Keep ngrok running

ngrok must be running at all times for the Add-on to function. We recommend configuring ngrok to start automatically with Windows by adding it as a scheduled task or a system service, so it restarts after reboots without manual intervention.

Configuring the Add-on

Once the Add-on has been installed by Storeganise, configure it at the site level.

In the Storeganise Admin Portal, go to Sites and select your site.
Navigate to Add-ons and open Paxton Net2.
Enter the following credentials:
- Paxton URL — The public ngrok URL from your ngrok setup (e.g. https://abc123.ngrok-free.app ). Do not include a trailing slash.
- Username — Your Paxton Net2 API username.
- Password — Your Paxton Net2 API password.
- Client ID — Your Paxton licence key.
Click Save.

The Add-on will attempt to authenticate with your Net2 server immediately. If authentication fails, a task will appear on the Add-on — check that your ngrok tunnel is running and that your credentials are correct, then save again to retry.

Mapping doors to units

Before the Add-on can grant unit-level access, each unit must be mapped to the corresponding door in Paxton Net2. Doors must already exist in your Paxton system. They can't be created via the API.If Facility access only is on, you don't need door names on your units.The door name you enter in Storeganise must match the door name in Paxton Net2 exactly. This match is not case-sensitive, but any spelling differences or extra spaces will cause provisioning to fail.

Set a door name on an individual unit

Go to Admin → Units and open the unit.
Find the Paxton door name custom field.
Enter the door name exactly as it appears in Paxton Net2.
Click Save.

Set door names in bulk

If you have many units to configure, use the bulk import method:

Go to Admin → Units and export your unit list.
In the spreadsheet, fill in the Paxton door name column for each unit.
Re-import the spreadsheet — all door mappings will be updated at once.

Note: Paxton Net2 door names are matched case-insensitively in Storeganise, but must otherwise be an exact match. Check for extra spaces or punctuation differences if a door is not being found.

Configuring shared facility access

Shared facility access points — such as the main gate, elevator, or lobby — should be listed in the Add-on settings so all customers are automatically granted access to them on move-in.

In the Storeganise Admin Portal, go to Sites → [Site] → Add-ons → Paxton Net2.
Find the Shared access points field.
Enter the names of the shared doors, separated by commas (e.g. Main Gate, Elevator, Level 1 Lobby ). Names must match your Paxton Net2 door names exactly.
Click Save.

If any of the names you enter are not found in Paxton Net2, a task will be created on the Add-on listing the unrecognised names. The Add-on will still function — this is a warning only — but customers will not receive access to unrecognised doors until the names are corrected.Note: Shared access is optional. If your facility does not have shared doors, leave this field blank.

Facility access only (gate-only sites)

Turn on Facility access only (paxton_facilityAccessOnly ) if Net2 only controls your gates and shared doors, and your units use padlocks. The setting is off by default and applies to the whole site.When it's on, the Add-on ignores Paxton door name on every unit and only manages your Shared access points:

Move-in: the customer gets a PIN and access to your shared access points.
Move-out and manual overlock: the customer keeps gate access while they have another unit at the site that isn't moved out or overlocked.
Overdue: gate access is removed, and restored with the same PIN once they've paid.
Unit transfer: the customer keeps gate access and their PIN.

To turn it on:

Make sure Shared access points has at least one door that exists in Net2
Go to Sites → [Site] → Add-ons → Paxton Net2
Turn on Facility access only and click Save

If there's no valid shared access point, the Add-on raises a task saying Facility access only needs one. Add the door, save, then resolve the task.

How access is managed automatically

Once the Add-on is configured and doors are mapped, the following workflows run automatically.

Move-in

When a customer completes a move-in:

A user account is created in Paxton Net2 using the customer's name, email, phone number, and address. If the customer already has a Paxton account from a previous rental, the existing account is reused — no duplicate is created.
A PIN is automatically generated for the customer and assigned in Paxton Net2. The PIN is stored on the unit rental and is visible to the customer in the Customer Portal.
Individual door permissions are created for each of the configured shared access points.
An individual door permission is created for the customer's specific unit door.

The customer can access the facility using their PIN immediately after move-in completes.If the unit has no Paxton door name configured, a task will be created on the unit rental. No access is granted until the door name is set and the rental is re-synced.

Move-out

When a customer completes a move-out:

Their unit door permission is revoked.
All shared facility door permissions are revoked.
If this was their last active unit at the site, their Paxton user account is deleted.
All Paxton fields are cleared from the unit rental.

If the customer has multiple units and only moves out of one, only that unit's door permission is revoked — they retain access to their other units and the shared facility.

Overdue payments

When a customer's rental is marked overdue:

All door permissions are revoked across all of their active units, including shared facility access.
Their Paxton user account is retained — it is not deleted, so access can be restored quickly.

When the overdue status is cleared (payment received):

All door permissions are restored, including shared facility access.
Access is restored immediately.

Note: If a customer has a manual overlock active (see below) when their overdue status is cleared, the manual overlock will remain in place. You will need to remove it manually.

Profile updates

When a customer's name, email, phone number, or address changes in Storeganise, the change is automatically synced to their Paxton Net2 user record. Existing access permissions are not affected.

Manual overlock

You can manually revoke a customer's door access at any time — for example, during a dispute, maintenance work, or a security concern — using the Paxton manual overlock field.

Applying a manual overlock

Go to the customer's Unit rental page.
Find the Paxton manual overlock field and set it to enabled.
Click Save.

The customer's unit door access is revoked immediately. If this is their only active unit, their shared facility access is also revoked.

Removing a manual overlock

Go to the customer's Unit rental page.
Set Paxton manual overlock to disabled.
Click Save.

Access is restored immediately, including shared facility access.Note: A manual overlock operates independently of the overdue payment system. If a customer pays an overdue invoice while a manual overlock is active, the overlock is not cleared automatically — you must remove it manually.

Manual overlock and multi-unit customers

If a customer has multiple active units:

Overlocking one unit revokes access to that unit's door only. The customer retains access to shared facility areas and their other units.
To lock a customer out of the facility entirely, you must enable Paxton manual overlock on all of their active unit rentals.

Re-syncing existing rentals

If the Paxton Add-on is enabled on a site that already has active rentals, those existing customers will not have Paxton access data stored in Storeganise. This means the Add-on cannot automatically manage overdue lockouts, move-outs, or manual overlocks for those customers until their access data has been imported.Use the Paxton resync field to import access data for an existing rental.Important: For re-sync to work, the following must be true:

The unit must have a Paxton door name configured, unless Facility access only is on.
The customer's email address in Storeganise must match their email address in Paxton Net2 exactly.

Re-sync a rental

Go to the customer's Unit rental page.
Find the Paxton resync field and set it to enabled.
Click Save.

The Add-on will search Paxton Net2 for a user with a matching email address and check for an active door permission matching the unit's configured door. If a match is found, the rental's Paxton fields — Paxton user ID, Paxton permission ID, and Paxton PIN — are populated automatically and the resync field is cleared.If no Paxton user is found with a matching email, or if the user has no active door permission for this unit, a task will be created on the rental explaining the issue.Note: Re-sync reads existing data from Paxton Net2 — it does not create new users or grant new permissions. If the customer does not have a Paxton user account yet, complete a fresh move-in instead.

Resync multiple rentals

To resync many rentals at once, update the unit rentals in bulk. Use Update unit rentals, not Update units: the resync field is on the rental, so Update units fails with "You do not have permission to update: rental".

Go to Sites → [Site] → Units, click the ⋮ menu and select Export
Keep only three columns: the unit name (for reference), rental.id and rental.customFields.paxton_resync
Rename the two rental headers to id and customFields.paxton_resync
Delete any rows with an empty id . These are vacant units with nothing to resync
Set customFields.paxton_resync to TRUE on every row and save the CSV
Go to Units, click the ⋮ menu, select Update unit rentals and upload the file

Test with two or three rows first. Each rental is matched to Net2 by email, so any customer who isn't in Net2, or whose email doesn't match, gets an error task on their rental instead.

Unit transfers

When a customer transfers from one unit to another, the Add-on automatically:

Grants access to the new unit's door.
Revokes access to the original unit's door.
Stores the customer's PIN on the new rental — their PIN does not change.
Clears all Paxton fields from the old rental.

The transfer is handled as a single atomic operation: the new door is added and the old door is removed in the same API call, so the customer is never left without access during the transition.If the destination unit does not have a Paxton door name configured, the transfer job will fail and a task will be created on the new rental. Configure the door name and retry the transfer job from within Storeganise.

Troubleshooting

Access was not granted on move-in

Check the unit rental for a task explaining what went wrong.

If the unit has no Paxton door name, or it doesn't match a door in Net2, fix it. If the site is gate-only, turn on Facility access only instead
Check the ngrok tunnel is running and the Paxton URL is current
Re-save the Add-on settings to re-authenticate
Contact support@storeganise.com to re-trigger access for the rental

Access was not revoked on move-out

The rental was probably never provisioned by the Add-on, for example the customer moved in before it was enabled.

Check the rental for a task explaining why
Set Paxton resync to enabled on the rental to import their access data
Contact support@storeganise.com to re-trigger the revocation

The Add-on is not authenticating

Storeganise can't reach your Net2 server, or the credentials are wrong.

Check the ngrok tunnel is running and the Paxton URL is current
Check your username, password and client ID
If you see a paxton_networkUnreachable task, check Net2 is running and the port in your ngrok command is correct (8443 by default)
Re-save the Add-on settings

A customer's PIN is not showing

No PIN was found in Net2, or assigning one failed. The task on the rental says which.

Set a PIN on the customer's user in Net2
Set Paxton resync to enabled on the rental to pull the PIN into Storeganise

A shared access point is not being recognised

A name in Shared access points doesn't match a door in Net2, so a paxton_invalidSharedDoors task is raised.

Check for spelling differences, extra spaces or punctuation
Correct the names and save. The task clears when every name is valid

The Facility access only task is still open after adding a shared access point

The task doesn't close itself once the problem is fixed.

Check Shared access points has at least one door that exists in Net2, and save
Resolve the task manually

A bulk resync says "You do not have permission to update: rental"

The file was uploaded with Update units. The resync field is on the rental, so it needs Update unit rentals.

Rename the headers to id and customFields.paxton_resync
Upload the file again with Units → ⋮ → Update unit rentals

A resync raised a task instead of linking the customer

Resync only links customers who already exist in Net2. It doesn't create users or grant access.

Check the customer's email is the same in Storeganise and Net2
Check they have an individual permission for their unit door, or for your shared access points if Facility access only is on
Set Paxton resync to enabled again

Custom fields reference

The following custom fields are created by the Paxton Add-on and can be viewed on unit and unit rental pages.

Field	Location	Purpose
Paxton door name	Unit	The door name in Paxton Net2 that corresponds to this unit. Must match exactly.
Paxton user ID	Unit rental	The customer's user ID in Paxton Net2. Set automatically on move-in; cleared on move-out.
Paxton permission ID	Unit rental	The ID of the customer's individual door permission. Used internally for reliable revocation.
Paxton PIN	Unit rental	The customer's access PIN. Visible to the customer in the Customer Portal.
Paxton manual overlock	Unit rental	Toggle to manually revoke (enabled) or restore (disabled) a customer's door access.
Paxton resync	Unit rental	Trigger to import access data for an existing rental from Paxton Net2. Clears automatically after use.

Ready to get started?

Send us your request and the Storeganise team will install the Paxton Net2 Add-on for you.

Note: You'll need an ngrok account to connect Storeganise to your on-premise Net2 server.

Request installation

Jump to