TM20 / Q9 Terminals

Access Terminal Setup

TM20 and Q9 fingerprint terminals speak the Timmy/Realand cmd / ret JSON protocol. You point the device at this server once from its on-screen menu, then manage it remotely from its device page.

Point the device at the server

On the terminal keypad, open the admin menu and enter these values. The server connection itself cannot be set remotely — it must be typed in once on the device.

On-device menu path

MENU → Comm Set → Ethernet → DHCP        : Yes
MENU → Comm Set → Server  → Server Req   : Yes   (Server Approval)
MENU → Comm Set → Server  → DomainNm     : iotaccess.xyz
MENU → Comm Set → Server  → SerPortNO    : 443

Field	Value	Notes
DomainNm	iotaccess.xyz	Hostname only — no https://, no www, no trailing slash, no path.
SerPortNO	443	The secure TLS port. iotaccess.xyz is HTTPS-only.
Server Approval	Yes	Connect to the cloud/domain server (uses DomainNm) instead of a local IP.

ℹ

After saving, the terminal connects to wss://iotaccess.xyz/ws and appears under Devices as a pending device. Approve it there to start managing it.

Find out if your terminal supports secure WebSocket (wss)

Because iotaccess.xyz is HTTPS-only on port 443, the terminal must speak secure WebSocket (wss / TLS). Most modern TM20/Q9 firmware does, but some older units only do plain ws. Use these checks to confirm.

Quick ways to tell

1. Try it directly (best test).Set the three fields above and save. Open this device's page in the dashboard. If the device shows up (pending or online) within a minute, your firmware supports wssand you're done.

2. Check the firmware menu. Look under Comm Set → Server for an SSL, TLS, HTTPS, or Secure toggle. If present, enable it — that confirms wss support. If there is no such option and the port defaults to 80/8080, the unit is likely plain-ws only.

3. Check the model/spec sheet.Search the model number for “TLS” / “SSL” / “HTTPS push”. Cloud-capable TM20/Q9 revisions list it.

4. Ask the server. If the device never appears after setup, it most likely failed the TLS handshake — a strong sign it only supports plain ws.

⚠

If your terminal only supports plain ws: it cannot connect to the HTTPS domain on 443. You would need a host that exposes a raw, unencrypted WebSocket port (for example a Railway TCP proxy port or a VPS), then set SerPortNO to that port and Server Approval to point at it. The current iotaccess.xyz domain is TLS-only.

Manage the terminal remotely

Once a terminal is approved and online, open its device page to find the Remote Managementpanel. Each button or form sends one of the commands below over the live WebSocket; the server translates it into the terminal's native JSON envelope.

settime

Sync the device clock. cloudtime is auto-filled with the server's current time.

Sent to device

{"cmd":"settime","cloudtime":"2026-06-14 09:30:00"}

setdevinfo

Push device options: language, volume, verify mode, screensaver, sleep, fingerprints per user, log warning threshold, re-verify interval.

Sent to device

{"cmd":"setdevinfo","deviceid":1,"language":0,"volume":5,"screensaver":0,"verifymode":0,"sleep":0,"userfpnum":3,"loghint":1000,"reverifytime":0}

opendoor

Remotely release the door relay (doornum selects the door on multi-door units).

Sent to device

{"cmd":"opendoor","doornum":1}

reboot

Restart the terminal.

Sent to device

{"cmd":"reboot"}

cleanadmin

Remove all admin privileges (enrolled users are kept).

Sent to device

{"cmd":"cleanadmin"}

initsys

Factory reset — erases all users, fingerprints, and logs. Irreversible.

Sent to device

{"cmd":"initsys"}

✓

The terminal acknowledges each command with a {"ret":"<cmd>","result":true} reply. The dashboard records this as a command ACK and updates the command status to delivered.

Connect via WebSocket Send Commands