A system for authentication/access control of a first physical location, the system comprising: a user device (12a, 12b, 12c); at least one access control device (16a, 16b, 16c) at the first physical location, wherein the at least one access control device 16a, 16b, 16c controls access to the first physical location; and a central, cloud-based cluster of computers that executes a subscription based access service application and a server identity authentication application to manage access to the first physical location through the at least one access control device (16a, 16b, 16c) at the first physical location on behalf of subscribing customers by: processing data received from a user device (12a, 12b, 12c) using one or more rules associated with the first physical location to determine that the user device (12a, 12b, 12c) is associated with access to the first physical location; generating an authentication credential in response to registering the user device (12a, 12b, 12c) with the first physical location; and sending, by the server identity authentication application, the authentication credential to the user device (12a, 12b, 12c) and the at least one access control device (16a, 16b, 16c); wherein the user device (12a, 12b, 12c) is configured to access the physical location through an application downloaded to the user device, wherein the application downloaded to the user device is managed by the subscription based access service application, and wherein the application downloaded to the user device stores the authentication credential and causes the user device (12a, 12b, 12c) to authenticate with the at least one access control device (16a, 16b, 16c) by wirelessly transmitting the authentication credential to the at least one access control device (16a, 16b, 16c). a user device (12a, 12b, 12c); at least one access control device (16a, 16b, 16c) at the first physical location, wherein the at least one access control device 16a, 16b, 16c controls access to the first physical location; and a central, cloud-based cluster of computers that executes a subscription based access service application and a server identity authentication application to manage access to the first physical location through the at least one access control device (16a, 16b, 16c) at the first physical location on behalf of subscribing customers by: processing data received from a user device (12a, 12b, 12c) using one or more rules associated with the first physical location to determine that the user device (12a, 12b, 12c) is associated with access to the first physical location; generating an authentication credential in response to registering the user device (12a, 12b, 12c) with the first physical location; and sending, by the server identity authentication application, the authentication credential to the user device (12a, 12b, 12c) and the at least one access control device (16a, 16b, 16c); processing data received from a user device (12a, 12b, 12c) using one or more rules associated with the first physical location to determine that the user device (12a, 12b, 12c) is associated with access to the first physical location; generating an authentication credential in response to registering the user device (12a, 12b, 12c) with the first physical location; and sending, by the server identity authentication application, the authentication credential to the user device (12a, 12b, 12c) and the at least one access control device (16a, 16b, 16c); wherein the user device (12a, 12b, 12c) is configured to access the physical location through an application downloaded to the user device, wherein the application downloaded to the user device is managed by the subscription based access service application, and wherein the application downloaded to the user device stores the authentication credential and causes the user device (12a, 12b, 12c) to authenticate with the at least one access control device (16a, 16b, 16c) by wirelessly transmitting the authentication credential to the at least one access control device (16a, 16b, 16c).