An access control device is described. The access control device may store a credential in the memory of the access control device. The access control device may receive an access token from a user device via a wireless receiver. The access token may be different from the credential. The access device may verify the authenticity of the access token by sending the access token information to a server. The access control device may receive an indication from the server that the token is valid. The access control device may send the credential to a reader device of the access control system managing access to a physical secure area.