A physical access control, PAC, system comprising: an authentication device including: physical layer circuitry configured to transmit and receive radio frequency electrical signals with a radio access network; processing circuitry operatively coupled to the physical layer circuitry and including an authentication engine configured to: receive access credential information stored on a credential device from the credential device via the radio access network using a cloud-based messaging service; authenticate the access credential information using the authentication device; and grant to the credential device access to a physical access portal according to the access credential information; wherein the system further includes a beacon reader device configured to detect a beacon signal transmitted by the credential device and transmit a beacon detection message to the authentication device in response to the detection of the beacon signal; wherein the processing circuitry of the authentication device is further configured to: initiate transmission of an activation message to the credential device using the cloud-based messaging system in response to the beacon detection message; and receive the access credential information from the credential device via the cloud-based messaging service. an authentication device including: physical layer circuitry configured to transmit and receive radio frequency electrical signals with a radio access network; processing circuitry operatively coupled to the physical layer circuitry and including an authentication engine configured to: receive access credential information stored on a credential device from the credential device via the radio access network using a cloud-based messaging service; authenticate the access credential information using the authentication device; and grant to the credential device access to a physical access portal according to the access credential information; wherein physical layer circuitry configured to transmit and receive radio frequency electrical signals with a radio access network; processing circuitry operatively coupled to the physical layer circuitry and including an authentication engine configured to: receive access credential information stored on a credential device from the credential device via the radio access network using a cloud-based messaging service; authenticate the access credential information using the authentication device; and grant to the credential device access to a physical access portal according to the access credential information; wherein receive access credential information stored on a credential device from the credential device via the radio access network using a cloud-based messaging service; authenticate the access credential information using the authentication device; and grant to the credential device access to a physical access portal according to the access credential information; wherein the system further includes a beacon reader device configured to detect a beacon signal transmitted by the credential device and transmit a beacon detection message to the authentication device in response to the detection of the beacon signal; wherein the processing circuitry of the authentication device is further configured to: initiate transmission of an activation message to the credential device using the cloud-based messaging system in response to the beacon detection message; and receive the access credential information from the credential device via the cloud-based messaging service. initiate transmission of an activation message to the credential device using the cloud-based messaging system in response to the beacon detection message; and receive the access credential information from the credential device via the cloud-based messaging service.