Schlage aptiQ & NDE/LE Cards Explained: Security & Compatibility

Schlage aptiQ is Allegion's brand for 13.56 MHz contactless smart credentials — the secure card technology that replaced 125 kHz proximity and magnetic-stripe cards across the Schlage line. An aptiQ credential is an AES-secured smart card, meaning the card and reader authenticate cryptographically rather than the card simply broadcasting a fixed number. Allegion's own credential documentation describes its high-security smart cards as using "128 AES encryption used for authenticity, confidentiality and integrity," and states that Allegion is standardizing on the current smart-card generation.

aptiQ is offered across a range of secure 13.56 MHz smart-card types, from earlier smart cards through the current high-security generation. The security-relevant point for a buyer is the family it belongs to: aptiQ is an encrypted smart credential, not a copyable proximity card, and that changes how additional cards are sourced.

Schlage NDE and LE are Allegion's wireless electronic locks, managed through the ENGAGE platform. They read aptiQ 13.56 MHz smart credentials at the door — as well as mobile credentials — so the same secure card can work on wired aptiQ readers and on wireless NDE/LE openings across a building. This is what lets an organisation extend electronic access to interior and remote doors without running wiring to each one.

Because NDE and LE are credential-agnostic within the aptiQ family, the security of the door comes from the credential and key configuration, not the lock hardware alone. A site standardising on aptiQ smart cards and, where wanted, Schlage Mobile credentials via ENGAGE can cover openings from main entrances to individual offices on one credential model.

Schlage aptiQ high-security credentials are secured with AES-128, which Allegion's documentation says is "used for authenticity, confidentiality and integrity." In practice that means the card proves it is genuine (authenticity), its data is encrypted over the air (confidentiality), and it cannot be silently altered (integrity) — the three properties a copyable proximity card lacks entirely. Allegion describes this generation as offering the highest tier of its card security and is standardising on it.

That AES-secured model is why an aptiQ smart card is not clonable the way a 125 kHz proximity card is: there is no fixed number to copy, and the reader exchange is cryptographically authenticated. As with any smart-card system, the real-world strength also depends on key management — which is where Allegion's custom-key service comes in.

The Schlage Custom Encryption Key Service (SCEKS) lets an organisation use its own custom encryption keys on aptiQ credentials instead of the default key. Allegion states that its smart credentials can be "configured with our default encryption key or with a custom key developed by SCEKS." A custom key means a card encoded for one organisation will not authenticate on another organisation's readers, even if both use aptiQ.

This matters because a default shared key is the single biggest weakness in any smart-card deployment — it is what makes cards interchangeable between sites. Moving to SCEKS custom keys is the step that turns aptiQ from "secure chip, shared key" into a credential genuinely bound to your installation. It also means additional cards must be encoded with your key, which is why they come through Allegion or your integrator rather than an open aftermarket.

Allegion designed aptiQ multi-technology readers specifically to bridge the move from 125 kHz proximity to secure 13.56 MHz smart cards. Its reader documentation describes them as a way to "transition your system from proximity to smart card technology at your own pace," reading "125kHz proximity and 13.56MHz contactless smart cards in a single unit." That lets a site keep existing prox cards working while it issues aptiQ smart cards.

Custom-keyed aptiQ smart cards are bound to your SCEKS key and come through Allegion or your integrator — Security ID Systems does not produce a compatible aptiQ smart card, and that is inherent to how the encryption works. Where we help is the 125 kHz proximity side of a migration, which is an open technology.

aptiQ multi-technology readers accept 125 kHz proximity from the common families — Schlage, XceedID, HID, and AWID — during a transition. Those open proximity formats we encode as fully compatible credentials that read identically on your existing readers, covering the doors still on prox while your secure aptiQ rollout finishes.