As of September 2026, an all-keys-lost job routes to exactly one of four places — your own tool, a credentialed secure-access route, a remote OE session on the manufacturer's software, or a bench operation on the module itself — and choosing wrong is what turns a two-hour job into a two-day one. This post is the decision tree, written for the mobile operator deciding whether to drive to the car at all.
We are not a key company. We do not cut keys, we do not stock transponders, and we are not going to tell you which programmer to buy. What we do is the module side: OE programming sessions on eight platforms, IMMO-OFF file work on the controllers in our coverage matrix, and a specialist network for everything outside both. A large share of our bookings come from locksmiths, which is why the routing question matters more here than the technique.
The four routes, and what decides between them
| Route | When it is the right one | Typical blocker |
|---|---|---|
| Your own aftermarket programmer | Platform and model year your tool genuinely covers | Coverage claimed but not current |
| Credentialed secure-access route | Gatewayed vehicle, immobiliser functions | Registration and vetting you must hold yourself |
| Remote OE session | Module needs programming or configuration first | Operation is vehicle-specific, confirm before booking |
| Bench / file operation | Module is out, dead, or the data is the target | Controller must be in our coverage or on the network |
The honest framing: routes one and two are yours, not ours. Routes three and four are where we come in, and they are usually needed because something upstream of the key has gone wrong — a module has been replaced, a controller is locked, or a previous attempt left the car in a state a key programmer cannot resolve.
Credentialed access is not optional, and it is not ours to give
In the United States, secure vehicle functions on most modern platforms are gated behind a credentialed registry rather than behind a tool purchase. The National Automotive Service Task Force administers the Vehicle Security Professional programme, which is the legitimate route for a locksmith or technician to obtain security information and perform immobiliser-related functions. That credential belongs to the individual who holds it. Nobody can lend it to you, and a service offering to work around it is telling you something you should take seriously.
Licensing sits alongside that and is a state matter. In Texas, locksmith licensing runs through the Department of Public Safety Private Security Program — not a trade board, and not the agency people frequently name by mistake. Verify your own jurisdiction; the requirements are not uniform and the penalties for guessing are not trivial.
“Half the AKL jobs that go wrong were routed wrong on the phone. Somebody hears ‘no keys’ and drives out with a key programmer, and the actual problem was a used module somebody fitted last week. That is a different job, different tools, different day.” — Mobile automotive locksmith
The three questions to ask before you drive
- Has anybody worked on this car already?This is the single highest-value question in the entire call. A car that has had a module replaced, a “cheap” programmer attached, or a used ECU fitted is not the job the customer described. Our used-ECU matching guide covers what has to line up for a donor module to work at all, and the answer is more than the part number.
- Does the car crank? A cranking no-start with no keys is one problem. A car that does nothing is a different one, and it might be electrical rather than security. The causes are enumerated in why a swapped ECU will not start — immobiliser leads that list, but it is not alone on it.
- What is the exact year, model, engine and market? Immobiliser architecture changes mid-generation far more often than badges do. Two cars a customer describes identically can need entirely different routes, which is why every answer on this site is per-controller rather than per-badge.
When the module itself is the job
The case that sends locksmiths to us most often looks like this: keys are the stated problem, but the immobiliser data lives in a controller that is locked, replaced, or unwilling to accept a new pairing. At that point the work moves from key programming to module work, and there are two shapes it can take.
An IMMO-OFF file.On supported controllers — Saab Trionic, several Bosch ME7 variants, the BMW MS43 family and others listed live in the coverage matrix— the immobiliser function can be removed from the calibration and the module returned as a file, at $100 uploaded. What that does and does not solve is covered in our IMMO-OFF cost and scope guide, and the honest headline is that it is a repair technique for a specific class of problem, not a universal key workaround.
An OE programming session.Where the module needs the manufacturer's own software — to be programmed after replacement, configured to the vehicle, or have parameters written — that is a remote session: $100 GM, $150 Ford/Lincoln, Nissan/Infiniti and Mazda, $250 Toyota/Lexus, Volvo, VW/Audi and Mopar. Whether a specific key or immobiliser operation is inside what a session can complete is vehicle-specific, and we confirm it at the enquiry stage rather than after taking money — while the car is still on your schedule and not on a lift.
Reading the module: bench, boot or OBD
If a file is the route, somebody has to get the data out. The three access levels are not interchangeable and the difference decides whether the module has to come out of the car at all. Our bench, boot and OBD read-method comparison is the reference: OBD is fastest and reaches the least, bench access reaches more at the cost of removing the module, and boot mode is the deepest and the most invasive.
If none of those are available to you, the module can simply be posted. Our mail-in service exists for the operator who has diagnosed correctly and owns no bench tooling, and the packing guide covers doing it without static damage or a lost connector.
What to quote, and what to quote it as
A recurring complaint from operators who send us module work is that the customer already had a number in their head before the call, and the number came from a website that priced a different job. Two habits fix most of that.
Quote the diagnosis separately from the fix.An AKL job on a car with a healthy module and a covered platform is one price. The same call-out on a car with a used ECU nobody mentioned is a different job entirely, and pricing them as one number means you absorb the difference every time. Charging for the attendance and the diagnosis, then quoting the fix, is not being difficult — it is how the job stays profitable when the second case appears.
Name the module step explicitly when it exists. If the plan involves an unlock, a file, or a programming session, the customer should hear that as a line rather than discovering it as a surprise. Our published prices make this easy to do honestly: $100 for an IMMO-OFF file on a covered controller, $150 or $250 for a session depending on platform, $250 for mail-in work. Those are our numbers, not estimates, and you can quote them to a customer before you commit to anything.
The alternative — absorbing module work into a flat key price and hoping — is how operators end up resenting the jobs that are actually the most interesting ones.
The economics, honestly
The reason routing matters is that an AKL job has a fixed revenue ceiling and a highly variable cost. Drive out with the wrong plan and the labour eats the job. The fleet makes this worse: S&P Global Mobility put the average age of light vehicles on U.S. roads at 12.6 years in its 2024 study, which is exactly the band where a car has had previous owners, previous repairs, and quite possibly a previous module.
For the shop or locksmith who hits these often enough to matter but not often enough to buy every tool, the third option is to not do the module work at all. Our specialist networklets you post the job for free and pay only if you accept a bid — the full workflow is in our post-a-job guide for locksmiths. Subcontracting the module half and keeping the key half is a perfectly good business, and it is what a lot of our regulars do.
Five ways an AKL job goes sideways
These are the patterns that turn a scheduled job into a lost afternoon. All five are visible before you leave, if you look.
- The customer is not the owner.Not always fraud — frequently a family member, a mechanic, a buyer mid-purchase. But documentation has to exist before immobiliser work happens, and discovering it does not exist while standing at the car is the wrong time.
- The tool's coverage list is aspirational. Coverage claimed at purchase and coverage in the current software release are not always the same thing, and the gap shows up on exactly the model years people call about. Check against the version you actually have installed.
- The battery is flat. A car that has been sitting because nobody can get into it has a battery that has been sitting too. Security and programming operations are the least tolerant of low voltage of anything you will do that day. A maintainer is the first tool out of the van, not the last.
- A previous attempt left state behind. Failed learn attempts, partial writes, a module put into a security lockout with a timer on it. Ask what has been tried; people under-report because they are embarrassed, and the honest answer changes the plan.
- The module is the problem, not the key.This is the one that sends the job to us. If the controller holding the immobiliser data is locked, replaced or unresponsive, no key programmer resolves it — the routes are the file or bench options above, or the network.
Proof of ownership, and why we ask
Immobiliser work sits close enough to vehicle theft that any operator worth using has a position on it. Ours is that proof-of-ownership documentation is required for immobiliser-defeat style operations, and that we would rather lose a job than be the weak link in somebody else's. The acceptable-use policy states it plainly.
This is also a useful filter when you are choosing who to subcontract to. A provider who does not ask is not being convenient, they are being careless, and their carelessness attaches to your business the moment you hand them a customer's vehicle data. The rest of the tells are in our provider red-flags guide.
We do not provide emissions defeat, delete files, or services intended to bypass emissions laws. Our services exist for tuning preparation, diagnostics, repair, motorsport, and off-road use where legally permitted. Customer is responsible for confirming legal use in their location and application.
That line is about a different category of work, but it comes from the same principle, and Section 203(a)(3) of the federal Clean Air Act is the statute behind it. An operation is either legitimate repair or it is not, and the answer does not change because a customer is in a hurry.
The short version
Ask whether anyone has already worked on the car, whether it cranks, and exactly what it is, before you drive anywhere. Key work with credentials is your route. Module programming and configuration is a remote session. Locked or dead controllers are a bench or file job, and the free identifier will tell you which variant you are holding before you commit to anything. Everything outside all of that goes on the network, free to post.