Short answer: Encode door credentials with your normal credential encoding process, before fingerprints are enrolled. Credentials encoded before enrolment require a fingerprint match; credentials added afterwards do not. To the encoder the card is a standard DESFire EV3 card.
Encode first, then enrol
Encode DESFire credentials onto the card before starting biometric enrolment. By default, credentials encoded before fingerprints are enrolled can only be read after a biometric match. Credentials encoded after fingerprints are enrolled can be read without one. The order to follow is: encode the credentials, enrol the fingerprints, then configure the access control system.
Use your normal tools
The card carries a standard DESFire EV3 application from NXP, so all DESFire EV3 security features are supported, and you encode it the same way as any other DESFire card. The card communicates with ISO 7816-4 APDUs, so use a PC/SC reader or encoder that supports ISO 7816 communication and ISO-wraps its commands, such as the HID OMNIKEY 5422.
Not every door needs a fingerprint check
A biometric match adds assurance, but also a small chance of rejection on each attempt. You may therefore want some credentials – for lower-security doors, for example – to work without a fingerprint check. Credentials encoded after fingerprints are enrolled do that.
Detailed configuration documentation
Detailed documentation on how to encode door credentials on IDEX cards, how biometric protection of credentials works, and how to configure your access control system for it, is available on request. It is not published here. If you are an integrator or a customer setting up door access with IDEX cards, contact us and we will share the documentation and help you through the setup.
See: Integrating with your access management system, How the card behaves at a DESFire reader and Card models and configuration.