Access design in a shared station is usually argued as a preference between codes, scans and app-based opening. It is better treated as a matching problem: each user type has different frequency, different context and a different consequence if their credential leaks.
Recipients: rare, unprepared, one door
A recipient opens one compartment, perhaps once a month, often on a phone with poor signal in front of the station. A one-time code that works without connectivity and expires with the collection window fits that reality. Requiring an app install at the door does not.
Couriers: frequent, trained, many doors
A courier opens many compartments a day and is operating inside a workflow the network controls. A scanned or account-bound credential is appropriate: it is fast in repetition, it ties every deposit to a person and a parcel, and it can be scoped so a courier credential never opens an occupied compartment belonging to someone else.
- Recipients: single-use, expiring, usable without an app.
- Couriers: role-scoped credentials bound to the parcel being deposited.
- Technicians: access granted against an open task and logged separately.
- Operators: remote opening permitted, always attributed, never silent.
Remote opening is the one to govern hardest
The ability to open any door from the platform is necessary and dangerous. It should be restricted by role, require a stated reason, and appear in the door history exactly like a physical open. An action that resolves a customer problem must never be one that cannot be explained afterwards.
A credential is a promise about who is on the other side of the door. Scope it to what that person actually needs to do.