Which cars block OBD key programming — and what you plug in

The Security Gateway Module (SGW/SGM) sits between the OBD-II port and every protected module on the vehicle's CAN bus. It does not block the connection itself: a scan tool plugs in, reads the VIN, pulls live data and reads stored fault codes with no bypass of any kind. What it blocks is anything that WRITES to the vehicle -- key and immobiliser programming, clearing DTCs (even a stored or history code), bi-directional controls and active tests, module coding, and teach-in/relearn/calibration procedures all fail past the gateway until it is bypassed or authenticated around. FCA/Stellantis built it to keep the CAN bus from being reachable by an unregistered device over the OBD port -- originally as a defence against remote/cellular hacking -- and it enforces that by refusing write-class traffic from anything that has not authenticated to it first.

There is no single on-screen string common to every tool, because each vendor writes its own dialog for this -- the two behaviours actually documented across the tool ecosystem are: (1) the connection and every read-only function work completely normally, and the failure only shows up the moment you ask for a write -- KM100/IM508/IM608-class tools throw a generic communication or IMMO-blocked failure on that step until the 12+8 cable is fitted; (2) on Autel's and Launch's own Android-based tablets specifically, the tool instead surfaces an AutoAuth authentication step as soon as it detects an SGW-equipped VIN -- you either log in there or the write step still refuses. The one literal, vendor-published line worth quoting verbatim, because it is the exact wording printed on every FCA 12+8 adapter's own fitment listing and is the single biggest wrong-purchase trap on this family, is: "Not available for 2021+ models with SGW integrated into BCM." A locksmith who buys a 12+8 for one of those VINs and finds no connector to plug it into is reading this exact failure, just off the box instead of off the tool screen. I could not independently verify a single literal on-screen error string from any primary source opened as of September 2026 (tool UI text of that kind is typically only visible in video walkthroughs, not indexed text) -- treat any specific quoted device dialog beyond the fitment-list line above as unconfirmed until sourced directly.

[PREP] Confirm the model year is inside the gateway-equipped range before booking: most of the Chrysler/Dodge/Jeep/RAM lineup picks up the Security Gateway at MY2018, but Jeep Wrangler JK and the Dodge Grand Caravan run their entire production with no gateway at all, and several 2021+ platforms moved the gateway inside the Body Control Module, where a plug-in 12+8 adapter has no separate connector to attach to -- check the cable vendor's own fitment page for this exact model before you buy or bring hardware. [1] Locate the physical connection point for this model: a discrete Security Gateway Module with a 12-pin and an 8-pin connector on most Chrysler/Dodge/Jeep/RAM cars (behind the radio, under the steering column, in a kick panel, behind the glovebox, or under a seat, varying by model), or the Radio Frequency Hub (RFH) instead on the Fiat-platform crossovers (500X, Renegade, Compass) and on RAM ProMaster/ProMaster City. [2] Unplug the module's two factory connectors. [ADAPTER] Route both connectors through the matching 12+8 bypass cable into the diagnostic tool's OBD interface -- use the tool vendor's own cable; Autel documents its cable going in at the RFH and explicitly does not support going in through the green CAN-bus star connector for this function, while Advanced Diagnostics' ADC2011 is built specifically for that STAR/CAN-C connector instead, at a location that varies by model. On a car where the gateway has been absorbed into the BCM (2021+ Grand Cherokee L/WL, Wagoneer, Grand Wagoneer) there is no connector, adapter, or patch cord that belongs here -- no cable-based bypass, including an L-JCD-style patch cord, is confirmed to work on this sub-case for any tool; stop and see the in-BCM note under traps instead of buying or fitting hardware. [3] Select the vehicle and the function on the tool as normal -- read and write access to the immobiliser and other protected modules is unblocked for the rest of this connection. [TEST] Start the engine on every key including the customer's originals, and confirm lock/unlock/panic on each remote before you call the job done. [WARNING] Reconnect the original SGW/RFH connectors before you leave -- the module is a genuine network firewall, not just an anti-aftermarket-tool lock, and the car should not go back on the road with it bypassed. [4] Run a post-scan and clear any DTCs the disconnection itself set.

AutoAuth (autoauth.com) is the manufacturer-sanctioned account route: the shop registers for roughly $50/year covering up to 5-6 users, then registers each individual tool by its serial number. Once logged in on a supported tablet, the tool exchanges an authorization code with the FCA/Stellantis server and gets back a temporary access token that unlocks bidirectional write access through the gateway for that session -- no cable needed at all. It is not available on every tool, or even on every tool within one vendor's own lineup: Autel ties it to its Android-based MaxiSys/MaxiIM tablets (the IM608 and IM508 family qualify) and explicitly does not extend it to the MK- or MX-series budget scanners; Launch offers the equivalent login on its own tools; Xhorse, Lonsdor and OBDSTAR have no AutoAuth option at all and are cable-only regardless of which model you own. AutoAuth only unlocks the GATEWAY. It is a separate thing from the NASTF-vetted Rolling PIN code that Stellantis's own IOP portal (stellantisiop.com) additionally requires for the immobiliser PIN itself on many late-model vehicles -- that credential needs its own NASTF VSP ID and an authenticator app, is time-limited to 12-24 hours per code, and its own vehicle list reaches back to pre-2018 models (2014+ Grand Cherokee, 2017+ Ram 1500) that never had a gateway at all. Getting through the gateway does not by itself mean the immobiliser PIN step is solved.

Reconnect the original SGW/RFH connectors -- or unplug the bypass cable entirely -- before the car leaves the shop. Every bypass-device vendor documents the same shape of workflow: locate the module, unplug it, connect the bypass hardware, program, confirm the job worked, then remove the bypass hardware and reconnect the module 'just like it was from the factory'. The gateway is a genuine network firewall against remote CAN-bus attacks over the vehicle's telematics/cellular link, not merely a speed bump for aftermarket tools -- leaving it bypassed removes that protection for good, not just for the session, and unlike AutoAuth's software token it does not expire or reset itself: the splice stays live in the wiring until a person removes it. Run a post-programming scan and clear whatever DTCs the disconnect itself set (dropping the gateway mid-session during a PIN read or key-learn throws its own codes) as part of the same step, not a separate visit.

Two different credential layers get conflated constantly, and they are not the same thing: getting past the SGW (via AutoAuth or a cable) only restores write access to the bus -- a separate NASTF-vetted Rolling PIN from Stellantis's own IOP portal is additionally required for the immobiliser PIN on many late-model vehicles, and that PIN system is older and broader than the SGW itself (it reaches back to pre-2018 vehicles like 2014+ Grand Cherokee that have no gateway to bypass at all). A tool passing the gateway does not mean the job is finished. Second, AutoAuth is not a universal FCA credential -- it is scoped per tool vendor and even per model within one vendor's own lineup (Autel's own MK/MX-series scanners are explicitly excluded from it), so 'does this tool have AutoAuth' has a different answer for every SKU, not just every brand -- see tools[] rather than assuming. Third, a flat 'MY2018+ needs the gateway bypassed' rule is boilerplate, not a fact about any specific model: Jeep Wrangler JK is documented by name as never receiving the gateway even in its final 2018 model year, and the Dodge Grand Caravan is absent from every gateway-fitment and location list found for this family despite running through MY2020 -- both plug in straight to OBD for their whole production run. Fourth, and the costliest mistake to make with a customer's car already on the lift: several 2021+ platforms -- Grand Cherokee L/WL, Wagoneer, Grand Wagoneer -- moved the gateway inside the Body Control Module; the 12+8 adapter has no separate connector left to unplug on any of them. One bypass-cable vendor's own exclusion list names Cherokee L/WL and Grand Cherokee L/WL specifically ('any 2018+ FCA vehicle except for Cherokee L/WL or Grand Cherokee L/WL'), not the Wagoneer twins by name, and vendor fitment pages separately say so in as many words ('Not available for 2021+ models with SGW integrated into BCM'). No cable-based bypass gets around this at all -- not the 12+8, not an L-JCD-style patch cord, not any tool's own adapter: a technician on a diag.net forum thread working a 2021 Grand Cherokee L reports plainly, "the 21 Grand Cherokee 'L' cant be done with Anything…..other than OEM Witech/Software…..so Bypass cable is useless." Buying a 12+8 (or any other cable) for one of these VINs on the assumption that 'it's a 2018+ FCA car, the usual cable will work' is a wasted purchase and a wasted trip. The only route confirmed working on the in-BCM sub-case as of September 2026 is the OEM's own dealer-level software; whether an aftermarket tool's own AutoAuth login reaches a gateway folded into the BCM is not confirmed by any source opened as of September 2026, so don't offer AutoAuth as a substitute for one of these VINs without checking that specific tool vendor's own coverage first. Fifth, the bypass connection POINT is brand-specific, not interchangeable: Autel documents its cable going in at the Radio Frequency Hub and explicitly does not support connecting through the green CAN-bus star connector for this function, while Advanced Diagnostics' ADC2011 is built specifically for that STAR/CAN-C connector instead -- don't assume a technique that works for one tool's cable transfers to another's.

Add Key, All Keys Lost, and PATS parameter-reset programming on Ford and Lincoln PATS-equipped vehicles. Reaching Ford's PATS/BCM security-access service over OBD is not blocked by a physical gateway ECU the way FCA's SGW is -- the barrier is getting through Ford's own seed-key security access, which on a 'coded' module needs a real PIN, and which Ford's own dealer software (FDRS/FJDS) has required a NASTF Vehicle Security Professional (VSP) login or an Assisted Immobilizer Reprogramming (AIR) request to reach since at least 2013. From 1 September 2026 that same NASTF VSP requirement is being enforced directly inside a leading aftermarket tool line (Autel's KM100 first, IM508/IM608 series to follow) on a North America IP, closing a gap independent tools had used to reach the same functions without formal NASTF vetting.

Which screen appears depends on the module's stored PATS security-access type, not on the tool brand. On a 'timed' module the tool's own on-screen prompt is a plain countdown notice -- reported verbatim as "Security Access will take 10 minutes, do you wish to continue" -- and a working key alone clears it once the wait finishes. On a 'coded' module the same prompt does nothing useful: the session returns to the main menu with no countdown, because the module is actually waiting on a PIN that was never supplied. Since 1 September 2026 the Autel KM100 adds a step in front of both cases on a North America IP: Autel's own site states the tool's 'key/immobilizer security functions... require a NASTF VSP credential' and that 'Ford models and certain AKL (All Keys Lost) functions may be restricted' before that login is completed.

[PREP] Check whether the vehicle's PATS module reports a "timed" or "coded" security-access type before booking the job -- a working key clears a timed module by itself after the on-screen wait; a coded module needs the PIN/credential route below no matter how long you wait. [1] For a tool that needs a manual PIN on a coded module, get the PIN in advance through a NASTF-vetted PATS PIN lookup under your own VSP or LSID account, a FORScan seed-key calculation license, or a commercial PIN-calculation service such as autokeyprog.com. [2] For a tool that runs its own paid cloud calculation instead (Autel's IMKPA Ford module, Lonsdor's Ford online module, Xhorse's or OBDSTAR's server-side calc), confirm the unit has a live internet or Wi-Fi connection instead -- these authenticate through the vendor's own server, and none of them are documented asking for a NASTF login as of this research. [ADAPTER] On an Autel KM100 from 1 September 2026 (IM508/IM608 series confirmed to follow), sign in with a NASTF Vehicle Security Professional credential through the NASTF authenticator app before the Ford menu opens at all on a North America IP -- register in advance, since NASTF approval takes one to two weeks. [3] On a 2021+ FNV2 platform (F-150, Bronco, Mustang Mach-E, Focus/Mondeo, Lincoln Nautilus/Navigator/Corsair -- confirm your model and year) where the tool's live-OBD route is not documented, remove the BCM, disassemble it, pull its fuses, and bench-read its D-flash data with an XP400 Pro programmer through an APB131 adapter. [4] Reinstall the BCM before continuing, then load the saved D-flash data into the on-car Key Learning step and finish Add Key or All Keys Lost as the tool's own prompts direct. [WARNING] Ford has pulled and partly restored its own IMMO functions on Autel tools in North America more than once, on a different timeline per tool: Ford/GM/Toyota AKL came off the KM100 specifically around September 2024; then Ford forced IM608, IM508 and KM100 alike to lose all Ford immobilizer functions on 25 August 2025; since then the IM608 and IM508 (not the KM100) regained named blade-key and smart-key Ford/Lincoln models through a Ford_IMMO V2.20 update in May 2026, while the KM100 separately picked up only a hidden Universal-Key AKL menu workaround in June 2026 -- open the tool's own Ford coverage list on the day of the job instead of trusting an older walkthrough or this card. [TEST] Run a post-scan and clear any PATS DTCs, disconnect the diagnostic tool for 20 seconds, then cycle the ignition through OFF/ACC/RUN before confirming the new key starts the vehicle with the security light off.

Ford's own sanctioned path is its dealer-level FDRS software (FJDS on older models) run through a genuine Ford VCM2/VCM3 interface, or a licensed J2534 pass-through box such as a VXDIAG VCX SE/NANO carrying an FDRS license, with an active FDRS subscription. Inside FDRS, PATS security functions stay hidden until the operator supplies either a full NASTF Vehicle Security Professional or Locksmith (VSPID/LSID) credential, or files a NASTF Assisted Immobilizer Reprogramming (AIR) request -- a no-vetting-required alternative where a NASTF-approved service provider runs the actual programming session remotely for a fee of $45 covering the shop's first five transactions each year and no charge after that. A third option some shops use instead of holding FDRS themselves is a commercial single-VIN one-time online PATS access session purchased through a Ford-authorized reseller, confirmed for Ford and Lincoln 2018-2025 models. Outside North America the equivalent credentialing body is different: EU/UK independents need SERMI accreditation rather than a NASTF VSP account, since NASTF itself is a North American organization.

When a job needed the BCM pulled for a bench read (2021+ FNV2 platforms), reinstall the module, restore its fuses, and reseat its connectors before doing anything else -- the tool only loads the saved D-flash data into the on-car Key Learning step once the BCM is back in the vehicle, not while it is still on the bench. For every PATS job, whether or not a module was pulled, disconnect the diagnostic tool for 20 seconds before cycling the ignition through OFF, ACC, and RUN to let the relearn settle, then run a post-scan and clear any PATS DTCs before confirming the new key starts the vehicle and the security light is out.

Active-alarm cables are not a PATS or credential bypass -- Advanced Diagnostics' ADC2025, Xhorse's XDFAKLGL, and OBDSTAR's P002 kit all solve one specific problem (a factory alarm actively triggered during All Keys Lost interfering with the session) and do nothing to satisfy the PIN or NASTF-credential requirement; citing one of these as the way through Ford's gate sends a locksmith to buy hardware that answers the wrong question. A 'coded' PATS module looks identical to a 'timed' one until the session is already running -- a coded module returns silently to the main menu instead of counting down, because it is waiting on a PIN nobody supplied. The NASTF VSP/SDRM credential is not a Ford invention: Chrysler, Volkswagen, GM, BMW, Audi, Mercedes and Toyota are rolling the same NASTF gate onto their own security functions on their own schedules, so a VSP account validated for Ford does not by itself cover every other make's tool session. Ford has pulled and partly restored its own IMMO functions from Autel tools in North America more than once over 2024-2026, so a coverage list, walkthrough video, or this card describing a working menu path is not a guarantee that path is still live -- check the tool's own coverage list on the day of the job. Outside North America, NASTF does not apply at all: EU/UK jobs are gated through SERMI, a completely separate accreditation body, so a NASTF VSP credential does not unlock a European-market Ford.

GM's Global B / CAN-FD platform (2020 model year on) blocks write access to the ECM and BCM at the security-code layer, not at the physical OBD port -- there is no separate gateway module inside the car to unplug, and plain OBD-II reaches the bus. Add Key and All Keys Lost both stall unless the session first obtains a 24-digit ECM security code and a separate 24-digit BCM security code from an authorized source. GM's own service bulletin states a dealership must never hand key-code data directly to a locksmith and instead directs them to NASTF's Vehicle Security Professional process. The older Global A trick of reading a 4-digit BCM PIN straight off the bus (worked 2010-2019) does not exist on this generation -- the security check moved server-side.

On tools that expose the manual code exchange (documented on the Autel IM508/IM608 GM routine), the screen first displays a '62-digit ECM Security Check Code', which is captured and exchanged for a 24-digit ECM code, then separately displays a '62-digit BCM Security Check Code' for the matching BCM round trip -- the key-learn step will not proceed until both are entered. On tools with an integrated NASTF login (Autel KM100 from Sept. 1 2026; the IM508/IM608 series in a later phase), the prompt instead asks directly for the operator's NASTF Vehicle Security Professional ID plus a passcode from NASTF's own multi-factor app, 'validated and logged within NASTF's SDRM database.' On Xhorse's Key Tool Max Pro the same wall shows as a bare 24-digit security-code entry field the tool cannot itself compute -- confirmed first-hand on a 2021 Buick Envision in a Xhorse blog post literally titled the tool 'asks for 24-digit security code.'

[PREP] [1] Apply for a NASTF SDRM Vehicle Security Professional credential at sdrm.nastfsecurityregistry.org before booking the job -- approval runs roughly 2-3 weeks and needs proof of insurance and business/locksmith licensing, so it cannot be done same-day. [PREP] [2] Install NASTF's multi-factor authentication app on your phone and confirm your VSP ID is active before you drive out. [ADAPTER] [3] Fit CAN-FD-capable hardware to the OBD-II port -- built into the standard cable on some newer flagship tools, or the vendor's own bolt-on CAN-FD adapter box fitted between the main cable and the DLC on others; confirm which applies to your tool before the appointment. [4] On a tool with an integrated NASTF login, enter your VSP ID and the app-generated passcode when prompted; the tool authenticates the session against GM's server and computes the ECM and BCM security codes for you. [5] On a tool without an integrated NASTF login, photograph the ECM application/challenge code the screen displays and send it with the VIN to GM's after-sales channel or a data service that already holds NASTF credentials; repeat the same round trip separately for the BCM application code. [6] Enter the returned 24-digit ECM security code, then the returned 24-digit BCM security code, into the tool exactly as received. [WARNING] [7] Do not trust a 'password-free' or 'no PIN needed' claim on a tool's marketing page at face value -- confirm the tool's own on-device coverage screen names this exact make/model/year first, since several such claims cover only a short named list of vehicles. [TEST] [8] Confirm the tool actually returns a working code and the key-learn step starts before you quote a firm price -- a stalled prompt after correct VIN and application-code entry means this tool does not yet reach this specific vehicle.

Register as a NASTF Vehicle Security Professional through NASTF's own SDRM registry (sdrm.nastfsecurityregistry.org/dotorg/enrollment). GM's own service bulletin 10-00-89-009F (Oct. 2024) states a dealership 'should not provide key code information at any time to a locksmith' and instead directs any locksmith seeking codes to NASTF.org -- confirming NASTF is GM's sanctioned channel, not a workaround. Approval takes roughly 2-3 weeks and needs two professional references plus proof of insurance and business/locksmith licensing. Reported fees for the credential itself diverge by source: NASTF's own support site states $435 for a two-year primary VSP membership and $250 for a two-year subordinate membership, while an August 2026 trade-press account of Autel's SDRM rollout states $335 for a two-year primary license (plus $150 per subordinate account -- that source does not attach a time period to the $150 figure -- and $100 for a two-year renewal) -- confirm the live number on NASTF's own site rather than repeating either figure as fixed. Once credentialed, the VSP ID plus a NASTF multi-factor passcode either logs the technician directly into a tool's built-in NASTF session (Autel's KM100 first, from Sept. 1 2026; the IM508/IM608 series in a later phase per Autel's own SDRM page) or is used to obtain the per-VIN ECM/BCM security code manually through a NASTF-registered intermediary. A separate, UNofficial channel also exists: online resellers sell a computed 24-digit code per VIN with no NASTF relationship at all (about $65 and a 5-minute turnaround from one such listing) -- GM's own bulletin language above indicates this sits outside the sanctioned path, so treat it as the locksmith's own commercial risk, not a documented official alternative.

Nothing is physically unplugged anywhere on this family, so there is no gateway module to reconnect. Close out the session the way every researched Global-B tool procedure in this database does: run a post-scan, clear any SECURITY/IMMO DTC the code exchange or key-learn cycle set, and confirm the dash security/theft indicator goes out on every key including the customer's originals before releasing the car. If the indicator stays lit after a key was accepted, disconnecting the 12V battery for a couple of minutes and reconnecting it is a documented recovery step on this same GM key-learn mechanism -- though the specific device-screen recording that documents it was captured on pre-Global-B (Global A) GM vehicles rather than on a Global B car, so treat it as a reasonable troubleshooting step on the shared GM architecture rather than a Global-B-specific guarantee.

Marketing language claiming a 'password-free' or 'no PIN needed' CAN-FD path routinely covers only a short named list of vehicles, not the whole platform -- Xhorse's own blog documents its Key Tool Max Pro asking for an uncomputable 24-digit code on a 2021 Buick Envision despite marketing a password-free bypass for 'new GM's', with the free path confirmed by name for only Cadillac CT4/CT5, Buick GL8/Encore, Chevrolet Cavalier/Trax and GMC Denali-generation trucks. Fee figures repeated verbatim across many case files in this database ('$150/yr membership') do not match any single verified source found as of September 2026 -- the closest match is a $150 SUBORDINATE (not primary) NASTF tier reported by an August 2026 trade article, which does not attach a time period to that $150 figure, while NASTF's own site states $435 for a two-year PRIMARY membership and $250 for a two-year SUBORDINATE membership; none of those confirmed figures is an annual $150, so do not repeat that number as verified. The security-code exchange is TWO separate round trips, not one -- a distinct ECM application/security code and a distinct BCM application/security code, each up to 62 digits on the challenge side, both required before the key-learn step unlocks. CAN-FD hardware requirements differ by tool: some newer flagships carry it in their standard VCI with no visible add-on, while others (OBDSTAR X300 DP Plus and siblings) need a specific bolt-on CAN-FD adapter box fitted between the main cable and the DLC -- a tool owned without that specific box is not CAN-FD ready even if its own brand sells one. As of this research pass, AutoProPad and Advanced Diagnostics Smart Pro carry no CAN-FD path on this family at all -- vendor coverage changes over time, so re-check each tool's own current coverage screen rather than trusting this snapshot indefinitely. Finally, this family is credential-gated, not cable-gated: unlike FCA's SGW, there is no bypass cable that skips the code exchange, so a locksmith who buys a 'GM CAN-FD bypass cable' expecting it to replace the NASTF/code step has bought a protocol adapter, not a solution.

On Mercedes-Benz vehicles from roughly MY2014/2015 (the FBS4 immobiliser generation) up to the onset of the NTG7/ZenZefi certificate wall (2021+, a separate and fully dealer-locked family in this database -- see mb_ntg7_zenzefi), Add Key and All-Keys-Lost programming is not blocked by a discrete gateway module or a bypass-defeatable lock the way FCA's SGW or Toyota's smart-ECU harness are. Mercedes gates write access to the EIS (Electronic Ignition Switch / immobiliser) at the security-code layer: producing a valid password for that specific EIS requires either an online cloud-calculation service reached through an aftermarket tool (Xhorse's VVDI MB token system, Autel's IMKPA/G-Box3 accessory combination) or Mercedes' own dealer XENTRY/DAS process -- none of the three is a purchasable cable that removes the check outright. This mirrors GM's Global-B credential model in shape (pay and wait for a code, not plug-and-defeat) but the currency here is a per-vehicle cloud token rather than a NASTF registration. Two of the accessory products most associated in the marketplace with 'Mercedes password calculation' publish, on their own current product pages, named Mercedes coverage that stops at the OLDER DAS3/FBS3 generation, not at the 2015+ chassis this family actually covers: Autel's G-Box3 names only W172/W204/W207/W209/W211, and Xhorse's base VVDI MB ('BGA') Tool and its token-subscription page both stop at W164 through W221/W246/W639. Advanced Diagnostics' complete Mercedes kit (ADS-2298) is bounded even more explicitly, to 'Mercedes(R) models produced from 1996 to 2014.' None of the three names a single 2015+ chassis. This is a genuine gap in what could be confirmed from current vendor-published material, not proof the mechanism has stopped working on newer cars -- but it means a locksmith cannot assume the classic 'IMKPA + G-Box3' or 'VVDI MB Tool + tokens' combination reaches a W205 or later car just because it is the answer for a same-decade W204/W211; the tool's own current coverage screen for that exact chassis is the only reliable check.

There is no single refusal screen the way NTG7's ZenZefi certificate check produces one, because this family is not gated by a diagnostic-session precondition -- it is gated by needing a computed password before the key-learn step will accept a new key. On Xhorse's VVDI MB ecosystem the tool reads the EIS -- either 'under OBD mode', which the vendor states 'will check car power automatically', or by removing the EIS and reading it on the bench/IR -- and then submits that data online for calculation: literally, 'Password calculation can get key password through EIS and working key (online)' for an Add Key job, with a separate, costlier path when no working key exists for All Keys Lost. A retry against the same module inside a short window is refused outright, not just re-billed: the vendor's own token-shop page states 'Once success calculate password for one SSID, the server will not accept calculate the acquisition data with same SSID in 2 hours.' On Advanced Diagnostics' older Smart Programmer workflow the same paradigm is worded as a step the operator never directly watches happen: 'The password needed to complete the programming procedure is calculated in the background by the system' -- with an internet connection and, per that vendor, 'an original key' both listed as requirements for that kit's Add Key procedure. Across all of these, the tell that a locksmith has hit this family (rather than a plain transponder job) is the tool asking to go online and consume a credit or token before it will proceed, not a refused connection or a named 'gateway' on screen.

[PREP] [1] Identify the exact EIS connector/cable this chassis needs before the appointment -- Xhorse and Autel each sell chassis-specific EIS cables, and a cable bought for an older W204/W211 job does not fit a W205/W213 EIS connector. [PREP] [2] Buy password-calculation credit ahead of the job -- Xhorse sells single tokens ($15.99 each), a 5-token pack ($70) and an unlimited annual plan ($289); Autel's IMKPA/XP400 Pro path bundles the calculation into the tool's own subscription instead of a per-car token. [3] For an Add Key job where a working key is present, run the tool's OBD-mode EIS read with the working key in the ignition or reader -- Xhorse's own product page states this mode 'will check car power automatically.' [4] For All Keys Lost, where no working key is available, submit the EIS read alone for calculation -- budget for roughly double the per-job token cost that an Add Key calculation on the same platform costs. [ADAPTER] [5] Remove the EIS module and connect it to the bench interface (Autel G-Box3, or the equivalent Xhorse bench/IR path) when the on-car OBD read fails or the tool's own coverage table specifies bench-only for this chassis. [6] Submit the captured EIS data online and wait for the vendor server to return the calculated password -- this is a network round trip, not an instant local computation. [WARNING] [7] Do not resubmit a calculation for the same EIS/SSID inside the 2-hour window some vendors lock after a successful calculation -- a repeat attempt inside that window is refused outright, not simply re-billed. [TEST] [8] Check the tool's own current coverage table for this exact chassis (W205, W213, W177, C118, X243, etc.) before quoting the job -- the two accessory products most associated with 'Mercedes password calculation,' Autel's G-Box3 and Xhorse's base VVDI MB Tool, name only pre-2015 chassis (W172/W204/W207/W209/W211, and W164 through W221/W246/W639 respectively) on their own current listings.

Mercedes does not gate this generation with the pure factory-order-only path that NTG7 uses (dealer XENTRY session under a per-ECU ZenZefi certificate, key shipped pre-programmed to the VIN) -- that is the separate, later mb_ntg7_zenzefi family. For FBS4/BGA-era cars, a Mercedes dealer runs essentially the same kind of diagnostic session an aftermarket tool is trying to replicate: a shop with a live XENTRY/DAS subscription programs the key locally, drawing the password from Mercedes' own backend rather than a third-party calculation service. No NASTF-style registration specific to this step was found in the September 2026 research -- the diagnostic-software subscription and factory backend access are themselves the gate on the dealer side. Independently, Xhorse and Autel each sell a parallel, non-Mercedes route to the same password, reached through the aftermarket tool itself and priced per vehicle: Xhorse charges $15.99 for a single calculation, $70 for five, or $289/year for unlimited use; Autel folds the calculation into the IMKPA/G-Box3/XP400 Pro accessory purchase and the tool's own software subscription rather than charging a separate per-car fee. Advanced Diagnostics' older Smart Programmer (ADS-2298, bounded to 1996-2014 model years) runs the calculation 'in the background,' needing an internet connection and an original key for that kit's Add Key procedure. None of these three publishes a named 2015+ Mercedes-chassis coverage list on its current product page, so for a confirmed W205/W213/W177/C118/X243 job, absent a tool that documents that specific chassis, the dealer route remains the one positively confirmed to reach the car as of September 2026; treat the aftermarket calculation services as the likely-cheaper option to try first and confirm on the tool's own coverage screen, not as a guaranteed substitute.

Nothing is unplugged on the vehicle itself for an OBD-mode password read or key-learn cycle, so there is no vehicle-side connector to restore afterward. The one family-specific physical step happens to the EIS module itself when a bench/IR read is used instead of an OBD read: the module has to come back out of the tool's bench harness, be reinstalled in the car, and be reseated correctly before the vehicle will accept the new key. Xhorse's own materials describe EIS handling as a per-model IR/bench read rather than a bus connector, and Autel markets its G-Box3 specifically on 'eliminating repeated EIS insertions/removals' across its named EIS types -- a feature that only matters because EIS removal-and-reinstallation is itself the normal step being streamlined, i.e. the module going back into the car correctly IS the reconnect step on this family. No source found as of September 2026 describes a post-job battery disconnect/reconnect or a family-specific DTC-clearing requirement; treat a general post-key-learn scan for stored fault codes as standard shop practice rather than a documented FBS4/BGA-specific step.

1. 'BGA' is ambiguous industry shorthand, not a fixed generation name, and this family's own aliases (BGA, VVDI MB token) inherit that ambiguity. Xhorse's own hardware, branded the 'VVDI MB (BGA) Tool,' documents its real coverage as W164 through W221/W246/W639 -- classic pre-2015 DAS3/FBS3-era Mercedes -- not the newer FBS4 cars this family is named for. This project's own case research reached the same conclusion independently, from the other direction: a corrected note on the W205 C-Class variant states plainly that 'BGA is not an FBS4 board. BGA is the last FBS3-era board family, one full generation BEFORE the system this car uses' and that the tool paths diverge. Meanwhile other case rows in this same database still describe BGA as if it were FBS4's own board style -- GLC X253 verbatim as 'FBS4 (proprietary AES, BGA package)', EQB as 'Mercedes FBS4 BGA (NEC/Infineon secured)', CLA C118 as 'BGA processor (Mercedes FBS4, NEC/BGA)' -- three different wordings of the same conflation. Both usages exist because 'BGA' is also a generic electronics-packaging term (ball-grid-array chip mounting) and FBS4's chip happens to be BGA-packaged too, just a different chip on the same physical mounting style -- retailers 'apply "BGA" loosely to any modern Mercedes key' per this project's own W213 case note. A tool bought because it is marketed as 'the BGA tool' is not guaranteed to reach this family's cars; check the model list, not the name. 2. Neither Autel's G-Box3 nor Xhorse's base VVDI MB Tool -- the two accessories that dominate the 'Mercedes password calculation' conversation -- names a single 2015+ chassis (W205/W213/W177/C118/X243) on its own current product page. G-Box3 names W172/W204/W207/W209/W211; Xhorse's VVDI MB Tool and its token page both stop at W164 through W221/W246/W639. This project's own procedure-section research for several FBS4 cases nonetheless asserts these exact accessories as a 'confirmed' path -- one CLA C118 case carries the badge 'W205 Add Key + AKL confirmed via IMKPA + G-Box3' with no source URL behind it anywhere in that case's own source file, and it directly contradicts what the vendor's current listing says G-Box3 covers. Treat every such in-repo 'confirmed via IMKPA + G-Box3' claim on a 2015+ Mercedes as unverified until the tool's own on-device coverage screen is checked for that specific chassis. 3. Advanced Diagnostics' complete Mercedes kit (ADS-2298) is bounded, in the vendor's own words, to 'Mercedes(R) models produced from 1996 to 2014' -- it does not reach a single car in this family by the vendor's own stated design, not by an accidental gap in marketing copy. 4. The password-calculation route needs a working key for a true Add Key job (Xhorse: 'get key password through EIS and working key'; Advanced Diagnostics: 'an original key is required'); All Keys Lost is a materially different, costlier calculation (Xhorse prices it at roughly double the token count) precisely because there is no donor key to read alongside the EIS. Quoting an AKL job at Add Key pricing or turnaround on this family is a scoping error, not a rounding one. 5. A successful password calculation locks out a second attempt against the same EIS/SSID for two hours on at least one vendor's system ('the server will not accept calculate the acquisition data with same SSID in 2 hours') -- a botched first attempt costs real appointment time, not a free retry. 6. C118 CLA and X243 EQB's membership in this family, rather than the later mb_ntg7_zenzefi tier, is settled, not open. An earlier pass of this file read Autel's 2021+ Mercedes secure-gateway announcement naming 'CLA (174); CLA (178)' among affected models as grounds for doubt about C118 -- but every other model in that same sentence follows one consistent chassis-code convention (C(206)=W206, E(214)=W214, S(223)=W223, GLC(254)=X254, EQS(296)/(297)=X296/V297), and 174/178 do not match C118 under it, so that citation names a different, newer CLA generation and was never evidence against this car. mbretrofit.it's own NTG-generation model rosters confirm the result directly: the NTG6 roster names 'CLA. C118 / X118 Shooting Brake (2019+)' and 'EQA / EQB. H243 / X243 (2021+)' outright, and the complete NTG7 roster names neither. Both cars stay on this family's password-calculation mechanism across their full production ranges. 7. Autel's G-Box3 is compatible only with the IM508S/IM608-series tablets per its own product page -- the KM100 budget tool has no accessory path onto this family's password-calculation mechanism at all, regardless of any general Mercedes menu entry the KM100 firmware may expose.

On Mercedes-Benz NTG7/MBUX2-generation vehicles (2021+: C-Class W206, S-Class W223, E-Class W214, SL R232, CLA, AMG GT, GLC and the EQ battery-electric range -- EQE/EQS), independent Add Key and All-Keys-Lost work is blocked because Mercedes gates every ECU write operation -- including EIS/EZS key pairing -- behind XENTRY diagnostic software, and XENTRY itself will not run a coding/programming session without a valid ZenZefi digital certificate. ZenZefi certificates are issued only to parties under a signed "DCS Certificate Letter Agreement" with Mercedes-Benz (dealers and vetted "Suppliers"), not sold as a retail product to locksmiths. Even a shop that clears that bar and holds a live XENTRY subscription (~$54,000 system cost) cannot program a key locally: Mercedes' own DAS4 process (in force for NASTF Vehicle Security Professionals since February 2022) only lets a credentialed technician mark the vehicle "present" in XENTRY and submit an online order -- the key arrives pre-programmed from the factory, tied to that VIN. No aftermarket key-programming tool (Autel, Xhorse, Lonsdor, OBDSTAR, AutoProPad, Advanced Diagnostics, Launch) publishes NTG7 EIS/key coverage. This is separate from Autel's 2021+ Mercedes "secure gateway access," which opens ADAS-calibration and body-control-module operations only and explicitly does not include key/immobilizer functions.

XENTRY's own certificate manager (ZenZefi) throws a certificate error before any coding session can start -- quoted wording varies by XENTRY version but reads as 'no valid certificate available', 'certificate expired', or a bare authentication failure; diagnosis (read fault codes, read live data) still works, but "variant coding, SCN programming and retrofit functions are greyed out or abort." Calling Mercedes for a path around it gets the same answer independent technicians have been given directly: "Programming rights are only available to authorized MB dealers at this time. The DAS 4 provision that was enacted in February 2022 for VSP's allows them to order Programmed keys only." Asked point-blank whether XENTRY itself can program a key, the answer from a tool vendor serving locksmiths is "No, not directly... XENTRY does not allow you to program keys manually in the traditional sense."

There are two sanctioned paths, and neither is an on-site bypass. (1) A Mercedes-Benz dealer runs the full XENTRY session in-house under its own dealer ZenZefi certificate -- the default route, and the one nearly every W206/EQS/W223 owner reporting a lost key online ends up using, at $600-1,000+ in the US and roughly £300-400 in the UK. (2) An independent shop that is both a NASTF Vehicle Security Professional (for the MBUSA Theft-Relevant-Parts / LSID gate) and a paying XENTRY Diagnosis subscriber (~$54,000 system) can use XENTRY to mark the vehicle "present," then complete Mercedes' online D-1/DAS4 key-order form; the key ships pre-programmed to that VIN, arriving next business day if ordered before roughly 3:30pm. Route (2) shortens the wait but is still a factory order, not local programming -- the shop never performs the cryptographic key-pairing step itself.

Not applicable in the way it is for a cable-bypass family: nothing is physically unplugged to do this work, so there is nothing to plug back in. The whole block sits in software -- a missing/expired ZenZefi certificate stopping XENTRY's coding session -- not in a removed module, so "reconnecting" isn't part of the job. The only after-work step reported anywhere in the sources is generic dealer practice (a XENTRY post-scan to clear any fault codes logged during the key-order/pairing session), not a family-specific reconnect procedure.

1. Autel's "Mercedes Secure Gateway Access" (2021+ CLA/AMG GT/C/E/S/SL/CLE/GLC/EQE/EQS) is real, but it unlocks ADAS calibration and body-control-module operations -- Autel's own announcement does not list key or immobilizer functions among what it opens. Don't read "Autel supports Mercedes SGW" as "Autel supports NTG7 Add Key." 2. Xhorse VVDI MB Tool retail listings carry a templated "now support all key lost" string that includes "W206" alongside chassis codes from a decade-plus earlier (W202, W164, W210, W164 2009-) -- the identical string is reused verbatim across a dozen-plus reseller mirrors. No independent technician thread, forum report, or VSP account confirms this works on the NTG7-gated W206; real W206 owners asking publicly about lost keys report dealer-only, $600-1,000+ outcomes with no aftermarket option found. Treat the Xhorse W206 claim as unverified vendor copy, not evidence. 3. Grey-market "MB Star C6 / SD Connect DOIP" VCI clones are marketed as supporting "W206 W223 EQE EQS NTG7 Online Programming & SCN Coding" -- that's the hardware interface only. Genuine online programming/coding through it still needs a valid ZenZefi certificate and an active XENTRY subscription, which the VCI resale does not include; owning the dongle does not get past the gate. 4. A separate product category -- bench adapters for the NTG7 head unit's own RH850 MCU chip (infotainment repair/reflash tools) -- also markets itself under the "NTG7" name. That's for a dead/bricked instrument cluster or COMAND screen, unrelated to the EIS/key-programming gateway this family covers; don't let an "NTG7 tool" search result be mistaken for a key-programming solution. 5. Aftermarket "XENTRY offline solution" packages (sold by reflash/tuning shops) unlock reading fault codes without an online login, but explicitly cannot do "online coding" -- SCN coding, module coding, or anything touching the key/EIS chain stays blocked. 6. Being a NASTF VSP with a Mercedes LSID only qualifies a shop for the DAS4 key-ORDER workflow -- it is a separate, narrower credential from the ZenZefi "Supplier" agreement itself, and neither one, alone or together, grants on-site key programming.

Nissan/Infiniti's 2020+ push-button smart-key platforms keep the immobilizer's write-access secret in a separate HFM (hands-free) module behind a 28-digit PIN challenge, instead of answering a plain OBD IMMO command the way the pre-2020 BCM generation does (2013-2020-era BCMs compute their own 20-digit rolling code online, no PIN entry at all). Whether plain OBD physically reaches the module before you hit that PIN wall depends on the tool: Autel's KM100 and IM508/IM608 (outside the B18 chassis specifically) get all the way to a PIN prompt over plain OBD with no adapter, so the block there is purely the credential. Lonsdor's own documentation instead describes plain OBD as unable to reach the module on this whole family at all -- its 40-pin cable is required before any PIN exchange happens. A tool with no way to read or calculate that PIN (Autel KM100 has no EEPROM/MCU read at all) simply cannot finish the job without the code arriving from outside the car.

Literal quotes from the sources read: [1] "Need 28 digits pin code (KM100 doesn't release the pin code)" -- Autel KM100, 2022 Sentra B18 add-key job. [2] "This procedure erases all registered key ID. Therefore, all of the customer's keys should be obtained before starting this procedure." -- KM100's own on-screen warning on the Nissan Key learning routine, shown whether or not the PIN wall is hit. [3] "Password extracted successfully but no connection to the system" -- Autel APB131 reading the HFM on a 2025 Kicks P16: the code came out but the tablet still could not reach the BCM (the 2025 chassis rewired the BCM connector, per the fix write-up). [4] "Autel failed to add key even with BCM40 pin cable. It still asks for pin code." -- field report, 2024 QX60: the 40-pin cable alone did not remove the PIN prompt on that car. [5] "Password (Pin Code) need for all key lost and IMMO part replacement." -- the Autel 16+32 adapter's own product page, i.e. even the vendor selling the "no password" cable states plainly that all-keys-lost still needs it.

[1] [PREP] Confirm the car is on this family's 2020+ secure-gateway generation (Sentra B18, Rogue/X-Trail T33, Pathfinder R53, QX60 L51, Ariya, Qashqai J12, Kicks P16) before you quote -- pre-2020 Nissan/Infiniti BCMs answer plain OBD with no PIN wall at all, and nothing below applies to them. [2] [PREP] Bring every key the customer wants to keep to the car -- the Nissan key-learn routine is a full erase-and-relearn, not an append, and any key not presented in this session stops working once it finishes. [3] [ADAPTER] Fit the tool vendor's own Nissan gateway cable in-line between the BCM and its harness -- a 16+32-pin cable on the B18 chassis specifically, a 40-pin cable across the wider platform -- instead of connecting the tool straight to the OBD port. Some tools (Autel KM100 off the B18 chassis) reach the module over plain OBD without this cable and stop at the PIN wall in step 4 instead; others (Lonsdor K518, per its own documentation) cannot reach the module at all until the cable is in-line. [4] Source the 28-digit HFM PIN before you start unless your specific tool-and-cable combination is confirmed to pull it automatically -- Autel's APB131 reads it directly off the HFM board through XP400/XP400 Pro, but that is a bench job (dashboard out, leads desoldered onto the chip -- see traps), not a quick cable step. No source confirms Lonsdor's 40-pin cable extracts the PIN itself; budget for sourcing the code separately on that route unless you have confirmed otherwise on the specific car. Get the code from the dealer, a NASTF Vehicle Security Professional, or a locksmith master otherwise: a tool with no EEPROM/MCU read, such as the Autel KM100, cannot produce this code itself under any circumstances, even with the gateway cable fitted. [5] [WARNING] Do not unplug the gateway cable or let vehicle voltage drop mid-read -- an aborted HFM/BCM read has bricked a B18 module in the field (about 1900 USD to replace at the dealer). [6] Run the tool's own Nissan add-key or all-keys-lost routine and present each key as it prompts. [7] [TEST] Start the engine on every key including the customer's originals and test proximity lock/unlock before you leave -- a key not presented during the erase-and-relearn session is now dead. [8] Remove the gateway cable, reconnect the BCM to its original harness, and put the tool back on plain OBD before you close up.

A J2534 pass-thru VCI can run Nissan's own dealer diagnostic/programming software (Consult III Plus, Consult III R2R, and NERS) over plain OBD-II, with no gateway cable needed to reach the software layer. Topdon's own Rlink J2534 product page states OEM software pass-thru support for 13+ brands including Nissan, and a verified-purchase review from a self-identified Nissan tech confirms it "run[s] Consult 3 plus ... identical OEM interface." Not every J2534 dongle gets there, though: Autel's own J2534 (Maxiflash Elite/JVCI/VCMI) does NOT connect to full Consult III Plus at all -- only to Consult III R2R and to NERS -- per a field Q&A on setting it up ("It never connects to the autel j2534"). Access requires a Nissan Tech Info / CONSULT account; NERS alone costs about USD 350/year. A field write-up on programming a 2024/2025 Infiniti QX60 smart key -- explicitly stated by that same source to also apply to Sentra B18 2020+, Rogue T33 2020+, Xtrail T33 2020+, and Pathfinder R53 2020+ -- reports Consult III Plus completing the job over plain OBD-II in about 5 minutes with no BCM removal, no soldering, and no 28-digit PIN entry ("This one way is life saver, 5 mins job, no disassembly, no soldering, no 28 digit pincode. All done via obd"), using a J2534 VCI such as Topdon Rlink X7, Mongoose GM, VXDIAG VCX SE, Smartlink, or Cardaq, and either a paid Consult 3+ subscription or, per the same source, "a special patched version of Consult 3+ without subscription" -- treat that patched/no-subscription route as informal, not an official path. The same source also reports Autel IM508/IM608 (with the BCM40 pin cable) and OBDSTAR G3 both still hitting the PIN wall on this exact vehicle, so the PIN-free result is specific to the Consult III Plus route, not a property of plain OBD-II access in general. The source does not distinguish Add Key from All Keys Lost -- it describes only "smart proximity key" programming -- so do not assume this is confirmed for AKL specifically without checking on the job. The only newest-model-year defeat actually documented in this family's sources is the 2025 Kicks P16 (see traps); the field report there names "Consult 4" -- a different, newer Nissan diagnostic product from the Consult III Plus documented above -- as a possible alternative to a CAN-pin workaround, without confirming whether Consult 4 itself avoids the PIN. Do not assume the Kicks P16 shares the Consult III Plus PIN-free route documented above for the earlier nameplates without checking current coverage first.

Every cable-based route in this family is a temporary in-line splice, not a permanent modification -- vendor install instructions describe unplugging the BCM/gateway module's factory connector and plugging the 16+32 or 40-pin adapter directly into the module, with no wire cutting. Reverse that after programming: unplug the gateway cable, plug the BCM's original harness connector straight back into the module, and refit any trim panel removed to reach it. Put the programming tool back on the plain OBD-II port for the post-programming test -- proximity lock/unlock, remote buttons, and an engine start on every key the customer is keeping -- and clear any DTCs the erase-and-relearn routine set before closing the job out. Do not leave a bypass cable connected after programming.

[1] This project has a standing caution that a "Nissan-40 (BCM cable)" is not gateway hardware, grouped with a Ford BCM emulator and Toyota's link-only 30-pin harness. Independent research for this family directly contradicts that for the specific products found: OBDSTAR's own product is literally named "NISSAN-40 BCM Cable" and its own wholesale listing carries the tag "[Bypass Cable]" with body text "Add Proximity Key (No need pincode)"; Lonsdor, Xhorse (two separate adapters) and AutoProPad/XTOOL each sell their own 40-pin or 16+32-pin cable for this exact chassis list, and AutoProPad's own listing uses the identical phrase "bypassing the security gateway module of the vehicle." This is cross-vendor, cross-tool, multiply-sourced evidence, not one vendor's marketing claim -- flagging it here rather than silently overriding the standing caution or silently dropping the sourced finding. Resolution: keep the standing NOT_GATEWAY_HARDWARE caution on the Nissan-40 / 16+32 cable family. Vendor "bypass" / "no pincode" naming describes what the cable lets the tool physically reach, not what it unlocks -- the same distinction this schema's own GM CAN-FD-adapter note draws (a protocol adapter is not a bypass just because it is the thing you must plug in to reach the bus). This family's own field evidence backs that reading directly: traps #2 (a 2022 Sentra and a 2024 QX60 both still hit the PIN wall with the "password-free" cable installed) and traps #3 (no cable in this family is genuinely password-free for All Keys Lost) show the cable is a physical link to the BCM, and the credential is the actual lock -- exactly what the default verdict of "credential" already reflects. Treat any single vendor's "bypass" naming for this family as marketing language unless a field report confirms the PIN wall is actually gone on that specific job. [2] The 16+32 "no password" gateway adapters are marketed as removing the PIN requirement for ADD KEY on the B18 chassis specifically -- but field reports contradict this in practice on the exact same chassis: a 2022 Sentra job needed a master-supplied PIN anyway, and a 2024 QX60 report reads "Autel failed to add key even with BCM40 pin cable. It still asks for pin code." Budget for the credential regardless of which gateway cable is bought, and confirm on the specific car before quoting "cable only, no code." [3] A 2023-09-15 obdii365.com source (independent of any single vendor, not a product listing) narrows but does not erase the ALL KEYS LOST PIN wall this family otherwise carries: Lonsdor's 40-pin cable is genuinely password-free for AKL, but ONLY on New Sylphy B18 2021- and New X-trail T33 2021- -- the same source states that on the very same Lonsdor cable, standard Sentra B18 2021 AKL "still need[s] to get password from 3rd party." OBDSTAR's 40-pin cable is genuinely password-free for AKL specifically on Sentra B18 2021.08-. Outside those three named nameplate/tool pairs, every source read for this family agrees AKL needs the 28-digit PIN -- Autel (the tool with the densest evidence in this file) needs it on every nameplate it covers, and QX60/Ariya/Qashqai/Kicks P16 carry zero documented PIN-free route on any tool. This is a narrow, nameplate-specific exception, not grounds to move the default verdict off "credential." The same source also gives this family's ADD KEY password-free claim real per-nameplate backing instead of vendor marketing language alone: Lonsdor covers Rogue T33 2021-, Pathfinder 2021-, Sylphy B18 2021-, Mitsubishi Outlander 2021-, New Sylphy B18 2021-, and New X-trail T33 2021- for Add Key (oddly, that source's own text reads "The function requires Nissan AKL license activated" directly under this Add Key list -- a probable wording quirk in the source, left unresolved rather than silently corrected either way); OBDSTAR covers Rogue T33 2021-, Pathfinder 2021-, Mitsubishi Outlander 2021-, and Sentra B18 2021.08- for Add Key. A cable marketed as "password-free" for one function is not automatically password-free for the other, and even within this AKL exception it is nameplate-specific, not chassis-wide. [4] The newest model year within each nameplate is a moving target that can defeat every aftermarket tool at once by changing the BCM connector's own wiring, not just adding a new lock: a 2025 Kicks P16 defeated an Autel IM508/IM608 on both the 40-pin bypass cable AND the APB131 HFM read because "the wiring of the BCM connector has changed" on that chassis, and the job only completed by probing the low-speed CAN-H/CAN-L lines with a CAN-FD adapter wired straight to the body CAN network under a 2024+ Pathfinder tool profile -- functionally a dealer-only job. Do not assume this generation's aftermarket coverage holds for a brand-new model year; check the tool's own coverage list for that exact year first. The same source names 'Consult 4' (not 'CONSULT III Plus' -- a different, newer Nissan diagnostic product) as an alternative to the CAN-pin workaround, without saying whether it avoids the PIN requirement -- treat that as an unconfirmed lead, not a documented PIN-free route. A separate source documents "Consult III Plus" itself (not "Consult 4") as a genuinely PIN-free route on this family's earlier nameplates, including the 2024 QX60 -- see official_route and era_note -- but that finding does not extend to the 2025 Kicks P16 or to "Consult 4"; the two products and the two findings are independent and should not be conflated. [5] Two Autel tools answer this family differently and are not interchangeable: the KM100 has no EEPROM/MCU read and cannot extract the 28-digit PIN under any circumstances, while the IM508/IM608 with the APB131 adapter reads it directly off the HFM board and needs no external credential. A locksmith who owns only a KM100 needs the code from elsewhere no matter which cable they buy; the same job on an IM608+APB131 can be fully self-contained. [6] Effective September 2026, Autel additionally gates KM100 Add Key / All-Keys-Lost / Immobilizer functions in North America behind NASTF's SDRM validation (a live VSP ID plus a multi-factor passcode per transaction) across every brand the tool covers, not something specific to Nissan -- Autel states IM508/IM608 join the same requirement "over the next year." This sits on top of, not instead of, the 28-digit HFM PIN this family already requires. [7] The BCM's physical connector location is not confirmed across the whole family. Go-Parts.com's own BCM guide places it in the driver-side footwell behind the lower dash trim near the interior fuse box, on 10mm bolts, specifically for the 2020-2022 Rogue Sport/Qashqai; a bypass-cable vendor listing separately describes reaching it "beneath the driver's dash" without naming a specific model. No source read for this family states the connector location on Sentra B18, Pathfinder R53, QX60 L51, Ariya, or Kicks P16 -- treat the location as vehicle-specific and confirm it on the exact car before the job, not as a fact this family shares. [8] Launch X431 IMMO Elite/Plus has no Nissan-specific cable SKU, PIN behaviour, or field report found for this family -- only generic vendor marketing ("secure access to SGW vehicles without gateway limitation") with no chassis list or mechanism named. This database's own per-case YAML for this tool on Nissan/Infiniti cases was already flagged by an earlier researcher as templated boilerplate repeated regardless of actual platform, not evidence. Left out of tools[] entirely rather than guessed -- do not backfill it from the boilerplate text. [9] The Autel APB131 route is not a quick in-line cable job like the others in this family -- reading the HFM PIN directly requires physically removing the dashboard to reach the module above the glove compartment, then desoldering/soldering leads onto the chip itself; the sourced walkthrough describes this as much harder on the Sentra than on the Rogue, and notes some Rogue/Sentra units already have a dealer security update applied that blocks this read method with Autel tools entirely. Do not let "self-contained, no external credential" read as "plug in and go" -- budget dashboard-out labor time and ask whether the car has already had a dealer security update before quoting this route.

Nothing blocks write access -- this is a connector-reachability problem, not a security lock. Every vendor page opened for this research markets its cable as running with no added credential at all (Xhorse: 'password-free smart key matching'; Lonsdor: 'Without Pin Code' / 'No need ADP'; OBDSTAR: 'without pin code'), and no tool procedure found adds any credential beyond the ordinary Toyota cloud seed-code calculation that every Toyota/Lexus smart key already uses regardless of box generation. What actually fails is physical: on this generation the smart-key/certification ECU's data lines live on their own 30-pin connector at the box itself. Advanced Diagnostics' own ADC2021 product page confirms the same target, describing its cable as connecting 'directly to the immobilizer control unit (Certification Unit)' -- not as defeating any check. The standard 16-pin OBD2 port does not reach that connector, so the Backup-Immobilizer-Data / Read-Immo-Data step every add-key and AKL flow depends on cannot complete until the harness is fitted inline -- once it is, the exact same PIN-free flow used on older Toyota/Lexus smart keys runs normally.

No vendor page or walkthrough opened for this research quotes a specific on-screen error banner for this generation -- unlike an active security gateway, there is no designed refusal message here to quote. The tell is structural, not an error screen: Xhorse and Lonsdor both split this generation into its own menu row before you attempt anything -- Xhorse's IMMO Program tree separates 'Smart key after 2016 -> Type 4 (8A-P4 Page BA)' from the older 'Type 3 (8A smart card)' row, and Lonsdor's K518 splits 'Type 3 (2022-)' from 'Type 1 / Type 2'. Select the newer row on a car with no harness fitted and the Backup Immo Data / Read Immo Data step does not complete -- it stalls rather than failing with distinctive wording, which is why the practical warning sign is the menu split itself, not a caught error. OBDSTAR's and Lonsdor's own product pages independently describe the harness as designed so the technician never has to pierce, hook, or probe wires to get a read -- confirming the alternative to fitting it is not a workaround, it is simply no read at all.

[1] Confirm this exact model/year needs the harness before ordering one -- check the tool's own onscreen Type/model row rather than assuming from the platform name; several 2023-2026 launches are not yet confirmed on every tool's coverage list. [PREP] Put a 12V-maintaining charger on the battery and get the tool onto Wi-Fi/data -- the PIN-free calculation runs on the tool vendor's own server, not locally. [2] Locate the smart-key/certification ECU -- commonly behind the glovebox, under a seat, or (Tundra) behind the driver-side lower dash panel; the exact spot is model-specific. [ADAPTER] Unplug the ECU's factory 30-pin connector by hand -- no wire piercing, hooking, or cutting -- and plug the matching harness (Xhorse XD8ABAGL, Lonsdor FP30, OBDSTAR Toyota-30, or Advanced Diagnostics ADC2021) inline in its place. [3] Run the OBD lead from the harness to the vehicle's 16-pin port and connect the programming tool. [4] Select the tool's Backup Immobilizer Data / Read Immo Data function (menu wording is tool-specific -- see the per-tool notes) and confirm the read succeeds before continuing. [ADAPTER] Disconnect the harness once the read is confirmed, and refit the ECU's original factory connector and any trim removed. [5] Continue the tool's normal add-key or all-keys-lost flow using the file just backed up -- no separate PIN or account credential beyond what that tool already requires for Toyota. [TEST] Test every new key alone, confirm the immobiliser/security light is out, and clear any DTCs the disconnect/reconnect may have set.

Toyota's own channel is TIS (Techstream) through the Toyota Security Professional program -- a paid subscription tied to NASTF registration. Snap-on's TIS locksmith-verification portal (which hosts Toyota's own program) describes the credential as a 'Vehicle Security Credential (VSC or VSPID) -- formerly LSID' confirmed with an Authy passcode against the NASTF registry, unlocking both key-code retrieval and immobilizer-reset access for Toyota/Scion/Lexus back to 1989 -- the same account system used on every older Toyota/Lexus platform, not a route specific to this 30-pin generation. Toyota's own reset-request workflow additionally requires a current Techstream software version and named dealer-manager approval before a reset proceeds. Unconfirmed by any source opened as of September 2026: whether Techstream itself needs a physical 30-pin harness at the certification ECU the way every aftermarket tool researched here does, or reaches the box over the standard OBD port through the dealer-grade J2534 interface -- treat that specific point as open.

The harness is a temporary inline splice, not a permanent modification. Every procedure researched for this generation (Xhorse, Lonsdor, OBDSTAR, Advanced Diagnostics) ends the read step by disconnecting the harness and refitting the smart-key ECU's original factory connector before continuing the add-key/AKL flow, and every vendor product page checked for this family independently emphasizes a clean pass-through design rather than wire-piercing or hook probes -- nothing is left spliced into the loom afterward. Refit any trim removed to reach the ECU and clear any IMMO/theft DTCs the disconnect may have set before returning the car to the customer.

(1) 'Gateway Bypass Cable' is a retailer's product-title choice, not Advanced Diagnostics' own marketing -- AD's own ADC2021 product page never uses the word 'gateway' anywhere and names the part plainly as the 'ADC2021 Toyota* Bypass Cable'; the 'Gateway' framing comes only from a third-party retailer listing (smallwoodlock.com: 'ADVANCED DIAGNOSTICS TOYOTA GATEWAY BYPASS CABLE ADC2021'). Either way the name is misleading for this family: nothing here is a security lock (verdict is clear), and AD's own product page describes the cable only as connecting 'directly to the immobilizer control unit (Certification Unit)' -- not as defeating a credential check. Read the cable's existence as evidence of the required cable/link, never of the verdict. (2) Two different Xhorse cables exist for this platform and they are not interchangeable. The OLDER XD8ASKGL 'Toyota 8A Smart Key Adapter' covers the pre-BA generation before this family and, per Xhorse's own listing, 'work[s] with Key Tool Plus/ Key Tool MIDI' only -- no VVDI2 or Key Tool Max/Pro compatibility is claimed anywhere on that page. The NEWER XD8ABAGL 30-pin/BA harness this family covers is a separate part that DOES pair with Key Tool Max Pro (via the Mini/FT-OBD accessory) as well as Key Tool Plus. Buying the wrong one for the platform generation or the tool on hand is a real, sourced failure mode. (3) Launch X431 has no cable for this generation at all. Launch's own official Toyota AKL kit -- CH-01 (mechanical/non-smart), CH-02 (24-pin, TMLF12 box), CH-03 (27-pin, TMLF18D/TMLF15 boxes) -- tops out at 4A/8A-A9/8A-AA smart keys on 27-pin-and-smaller boxes; the product listing makes no reference to 30-pin or 8A-BA at all. Do not quote a Launch AKL job on a car confirmed to carry the 30-pin box. (4) OBDSTAR sells more than one hardware revision of its Toyota-30 cable, and they are not both universal: the retailer-confirmed 'blue V2' revision explicitly does not work with Autel tools, even though the base cable's own compatibility list names Autel's MaxiIM IM508/IM608 series. Confirm the exact revision before pairing it with an Autel tool. (5) Retailer category pages -- OBDSTAR's own included -- advertise a blanket '2020-2023+' window for BA coverage that does not hold at the per-model level: this repo's own cross-tool case research places Sienna and Venza's own first model year (2021) as still pre-BA, with the harness only becoming mandatory from MY2022 on most nameplates. Treat a bare year range on a parts-catalogue page as marketing shorthand, not a per-model cutoff -- see era_note.

SFD is a session-based cryptographic access-control layer sitting in front of the write-level diagnostic functions on the CAN/DoIP gateway (commonly addressed as module 19) and the modules behind it: coding, adaptation channels, parametrization/basic settings, and most actuator/active tests are gated. Reading fault codes, live measured values, and a plain auto-scan are NOT gated and work with no token at all. For this database specifically, add-key / all-keys-lost / key adaptation sits inside the gated set - VW's own FAZIT/GeKo description names 'the vehicle keys to the vehicle' as one of the three things the same authorization unlocks, alongside immobilizer-ECU calibration and component protection (A/C unit, navigation, etc). SFD2, the stricter follow-on tier, narrows this further: it re-locks the WRITE side specifically (coding/adaptation/parametrization) behind a second, per-session manufacturer-signed token layered on top of the base SFD unlock; reading stays open under SFD2 exactly as it does under SFD1.

Autel's own tools show the block two ways. On the security-access screen before any online step: "Vehicle Diagnostic Protection(SFD) not unlocked" (with a "Manually unlock SFD" option), or deeper in a locked module: "Diagnostic firewall is current active. You must first enable access to 19 - Gateway and then disable the diagnostic firewall." The unlock path is Control unit -> Security access (login) -> Online unlock SFD -> Continue -> Authenticate (Google Authenticator, 6-digit code) -> Send, and the tool shows "the remaining SFD unlocking sessions" before you commit one. On success it reports "SFD unlocking successful!"; once the ~90-minute window lapses, "the ECU will automatically lock itself, and need to unlock again." Lonsdor's own coverage FAQ states the same wall in prose rather than on-screen text: "Lonsdor also supports unlocking SFD security gateway for 2023+ VAG models. But users need to obtain unlock code from 3rd party" - the tool acknowledges the gate exists but will not hand you a key through it on its own. Porsche's PIWIS 4 equivalent enforces the same online-only rule: "offline unlocking is not available", and only "official dealers, certified workshops, or authorized third-party services can generate SFD unlock codes."

[PREP] Confirm which SFD tier the VIN carries before booking the job - SFD1 (2020+ MQB Evo/MEB) and SFD2 (rolling out from August 2023, expanding through 2024 across MQB Evo/MEB/MLB Evo and the Porsche equivalent) unlock through different processes, need different tokens, and price out very differently - do not quote one job for the other. [PREP] Confirm the scan tool and its VCI are DoIP-capable - the SFD security-access function does not run on legacy non-DoIP tablets (Autel's own Android-4.0-era MaxiSys, MaxiSys Pro, MS908 and MS908 PRO cannot run it at all) even when the same tool is otherwise VAG-licensed for immobilizer work. [PREP] Bring a live internet connection to the car - every implementation sourced here is an online round trip to a VAG (or, on Porsche, PPN) backend server; there is no offline calculation. [1] Connect to the OBD-II port, select the brand and target control unit (commonly listed as address 19 - Gateway, or the specific module to write, e.g. 01 - Engine Control Module), and open Security access (login) to read the vehicle's SFD seed/challenge data. [2] Obtain the signed response for that seed. On a tool with a native in-app purchase (Autel: Online unlock SFD, $15 for a 24-hour single-VIN token or $120/year unlimited), buy it directly in the tool. On a tool without native purchase (Xhorse, Lonsdor), copy the seed to a third-party token reseller's site along with the VIN and wait for the signed response. [3] Enter the signed response/token back into the tool and confirm the unlock - Autel's own confirmation reads "SFD unlocking successful!" [TEST] Do not start the actual coding/key-programming job until the tool confirms the unlock itself succeeded - a token that fails to apply is a different failure from the write failing afterward. [WARNING] The unlock is a session, not a permanent state - about 90 minutes on every implementation sourced here, after which the gateway re-arms itself automatically and the whole sequence repeats. Sequence the actual programming work inside that window. [WARNING] An SFD1 token does not open SFD2. If the reseller or in-app purchase does not explicitly say it covers SFD2, assume it only clears the base gateway - on an SFD2 car the write can still come back failed after the gateway itself reports unlocked, exactly as reported by Porsche PIWIS/Launch X431 users on 2023+ builds.

Two parallel official paths exist, both flowing through the same VAG-Group backend. In the US (this database's primary market): register as a NASTF Vehicle Security Professional (VSP/VSC credential), then register directly as an independent shop with VW of America / Audi of America's own erWin portal - a $100 one-time application fee, a diagnostic-software subscription at $175/week or $1875/year per brand, and one free security certificate with registration ($600/year for each additional one). That registration is what lets you run an authenticated ODIS session and clear the SFD/component-protection gate live; the same VSC credentials then let you order the physical key itself (a 'Main Key Kit' for 2008-and-newer cars) at keys-vw.com or keys-audi.com. Everywhere VAG sells cars, the underlying authorization is the same thing under the name FAZIT/GeKo: 'a function that is available together with the online connection of ODIS' that unlocks 'the calibration of electronic control units of the immobilizer..., the component protection..., as well as the vehicle keys to the vehicle' - in SERMI-regulated markets (EU) this now requires company + individual registration at a trust centre, identity verification through a 'Digidentity Wallet' app, and an importer-assigned diagnostics role on the Group Retail Portal, rather than the older paperwork-only route. Porsche's equivalent (PIWIS 4 plus a PPN network subscription, ~$17/hour reported) runs on the same principle - dealer or Porsche-approved-workshop credentials, online-only, no offline path. Outside any of these accounts, the practical aftermarket route is a paid third-party SFD-token service (e.g. vaglogins.com for SFD1) that performs the same seed/response exchange on the locksmith's behalf without the locksmith holding a VAG account at all - priced far below a dealer subscription per vehicle, but, per the SFD1/SFD2 trap above, not proven to reach the harder tier.

Nothing to physically reconnect - this family has no separate gateway module to unplug or restore; the entire block is software/credential, not hardware (see connectors.obd_direct). The unlock itself is inherently temporary and self-closing: every implementation sourced here reports roughly a 90-minute active window per token/session, and Autel states plainly that once it lapses 'the ECU will automatically lock itself, and need to unlock again' - no manual re-lock step is described anywhere. VAG's own documentation is consistent with that by design: SFD and SFD2 'cannot be permanently disabled using VCDS or ODIS', i.e. the protection is meant to always spring back on its own. Porsche's PIWIS 4 process matches it - each session needs 'a new request' rather than staying open indefinitely. Practical consequence for the job: there is no post-job step to undo, but there is also no way to hold the gate open past the window - if a key-programming job runs long, the fix is another token/session, not a physical reconnection.

SFD1 and SFD2 are different locks, not two names for one thing - conflating them is the single most expensive mistake here. SFD1 (2020+ MQB Evo/MEB) is what nearly every reseller and in-app tool purchase actually sells; it is bridgeable by a seed-and-response exchange a third party can calculate without holding a VAG account. SFD2 (rolling out from August 2023, expanding through 2024, mandated by UNECE R155/R156) demands a real manufacturer-signed token, and sourced material describes it as materially harder and far more expensive to clear (~$420 vs ~$50 on one documented reseller's price list) - ordinary SFD1 token sellers, per the sources here, do not cover it. A quote written from 'the car needs an SFD unlock' without checking which tier can be wrong by an order of magnitude on price, or simply undeliverable with the tool in hand. A successful gateway unlock is not proof the write will succeed. On SFD2-protected cars the write itself carries its own separate token wall - Porsche's own description is 'a one time unique token for each parameter' - and Rennlist owner reports describe Launch X431 (and other tools) returning a plain 'failed' on the coding step immediately after the gateway itself already reported unlocked. Budget the visit around the write succeeding, not around the unlock screen turning green. Vendor naming invites the same axis confusion this whole section exists to prevent: a product literally named a 'VAG SGW Connection Package' or 'SFD Access Package' (Autel reseller listings use both) is a bundle of online unlock tokens/licenses, not a cable or dongle - there is no hardware in this family to sell. Treat any 'package' or 'connection kit' name here as a credential product until a listing proves otherwise. Tool capability is not uniform even among tools that are otherwise fully VAG-capable. Legacy non-DoIP Autel tablets (MaxiSys, MaxiSys Pro, MS908, MS908 PRO) cannot run the SFD function at all, regardless of subscription. Separately, a companion key generator built around a basic VCI rather than a full diagnostic head unit (this database's Autel KM100 is the documented example) has no path to the component-protection data SFD gates in the first place - not a harder route, no route at all - so quoting it for add-key/AKL on an SFD-era car is a wasted call-out before the gateway question even comes up. And a tool's own PRE-SFD online-calculation service (AutoProPad G2/G3's documented VW/Audi coverage is the sourced example here) can legitimately handle the older pre-2020-ish V850/component-protection generation while having no documented capability at all on the actual SFD/SFD2 generation this family covers - 'reaches the old generation' is not evidence it reaches this one. On Porsche specifically, tool generation may matter as much as the account: the cited PIWIS 4 walkthrough documents the 2024+ process in detail but does not address PIWIS 3 at all - confirm PIWIS 3/PPN capability on SFD-protected builds directly with Porsche or PPN before quoting a job on the assumption it cannot do this, rather than treating the sourced material's silence on PIWIS 3 as proof it is incapable. Finally, apply the same boilerplate caution the FCA/GM families in this same guide already carry: an SFD/SFD2 mention pasted near-identically across many unrelated case files describes the PLATFORM, not necessarily that exact car's own build date - the real gate is the VIN's production date against the platform's rollout window (see era_note), not the presence of the sentence.