Net2 by Paxton

Automatically issue access to both guests and employees with the Net2 access control integration for Envoy

Updated over a week ago

How does this app work?

This solution allows visitors to automatically receive credentials during sign-in as well as expire Net2 by Paxton credentials during sign-out using the Net2 API. For customers utilizing Envoy Workplace, this app also offers support to activate and suspend employee access automatically during employee sign-in and sign-out.


  • Operator permissions are required to authorize this integration.

  • This integration only supports Net2 version 6.05.10330.5472 or greater.

  • The following IPs must be whitelisted for inbound and outbound communication:




  • Validate the port configured within Net2 and confirm the port is whitelisted alongside the IPs above

  • Paxton10 does not support any API integrations, this was advised by the Paxton team. Therefore Envoy's integration only functions with Net2.

Enabling the Envoy + Net2 integration

Depending on your network security, it may be necessary to allow-list Envoy production IPs for access into your Net2 instance before proceeding. The Envoy production IPs are listed in the setup.

  1. Net2 by Paxton Plugin: Navigate to Apps > All Apps.

  2. Search for Net2 by Paxton > Click on it > Click Install.

  3. Allowlist instance: In order to facilitate this connection it is necessary to provide credentials and remote connectivity to your Net2 instance to be accessed over the internet. If your network enforces IP blocking or "allow listing" it will be necessary to enable the following Envoy production IPs:




  4. API Access: Proceed to the API Access step and enter your Net2 credentials.

    1. Note: Operator permissions required

      1. Client ID can be found within your license file

  5. Visitors: This section will allow you to customize the Net2 by Paxton integration behavior for Visitors signing in through Envoy.

    1. On the Visitor Types step, select the desired visitor to permission group mapping.

      1. The drop-down menu on this step is automatically populated based on the visitor flows on the location as well as the access levels pre-configured in Net2. If you do not see your intended groups then you must revisit your permissions within Net2.

      2. The drop-down menu allows multiple groups per visitor type, as well as an additional visitor to group mappings with the, “add another” button.

    2. Invite Required [Optional]: Visitors will not be registered into Net2 during sign-in if this option is enabled and they do not have a previous invite.

    3. Early Access: This option allows you to specify a duration of access prior to the scheduled visitor arrival for the visitor to access the facility (e.g., parking, navigating to a meeting room, etc).

    4. Access Duration: This option allows you to specify the duration of access for visitors.

  6. Workplace: Once your credentials are submitted successfully you will proceed to the Workplace step. This step allows you to customize the Net2 functionality for employees signing into Envoy through Workplace.

    1. Workplace Enabled: This option will enable all options in the section. Disabling this option will disable all options regardless of their state (e.g., "Disabled During Sign Out" toggled on).

    2. Exclude Employees: This option allows you to select employees to entirely exclude from Envoy Workplace functionality in the Net2 integration.

    3. Employee Access Duration: This option will allow you to set a time period in which employee access cards in Net2 are active after a successful Workplace attestation.


If you're an Envoy customer then you already know your support is our priority — whether it be through our easy-to-access intercom bubble, email, or your dedicated CSM. Whatever your preferred means of communication just know we're here to make the process as easy as possible.

Did this answer your question?