Short answer: There are two ways to get fingerprints onto cards: users enrol themselves with the IDEX Card app on their own phone, or your organisation enrols each user at an enrolment station. The difference is who verifies identity at the moment of enrolment, and who can manage enrolment and re-enrolment afterwards.
Self-enrolment with the IDEX Card app
The user enrols their own fingerprint using the app on an NFC-capable iPhone or Android phone. The user's PIN is required, so a card cannot be enrolled by whoever happens to be holding it. See: Security management for mobile enrolment.
Suited to smaller organisations that trust each employee to manage their own biometric credential, and to distributed teams without an issuance desk. No equipment and no desk to staff. The user holds the card against the phone's NFC antenna during enrolment. See: Decentralised enrolment – mobile apps and Tips for a successful enrolment.
Centralised enrolment at the enrolment station
An operator verifies who the person is, then enrols them at the enrolment station. The fingerprint on the card provably belongs to the person your organisation verified – which is the purpose of the model.
It is also the simplest enrolment experience: the card sits in the station's reader, so there is no phone to position. The user only places a finger on the sensor, guided by the operator. Suited to security-conscious organisations issuing from a central desk.
What the choice decides
| Self-enrolment | Centralised | |
|---|---|---|
| Who verifies identity at enrolment | The user themselves | An operator |
| Enrolment experience | On the user's own phone – the card must be held in the right spot | At a desk – the card sits in a reader, and the operator guides the user |
| What you need | Users' own NFC-capable phones and the app | An enrolment station and named operators |
| Best fit | Smaller or distributed organisations | Central issuance, higher assurance requirements |
| PIN | Set by the user in the app at first use; protects enrolment and re-enrolment, and on cards with FIDO also serves digital sign-in | If present the FIDO pin is set during the enrolment process. |
| Re-enrolment | In the app, with the PIN | At the desk with the enrolment station, with identity verified again – station-issued cards. Enrolment using the public IDEX Card app is blocked. |
Supervision is what gives centralised enrolment its assurance
Centralised enrolment provides assurance because enrolment is supervised. If the station is placed on a front desk and enrolment is not supervised, the card carries a fingerprint that nobody verified, and the assurance is lost. See: Enrolment station trust model.
What does not change
Whichever model you choose, the fingerprint data stays on the card, and your organisation keeps control of what the card can do – door credentials in your access control system, passkeys in your identity provider. Enrolment binds a person to a card; it does not grant access by itself. See: Security and privacy architecture at a glance and Lost or stolen card: revoke and replace.
Next step
Chosen a model? Go to Fingerprint enrolment for the practical steps in each, and Rolling out cards across your organisation for how to plan the rollout.