An access control system, comprising: a credential service operable to generate an encrypted programming credential and an encrypted mobile credential, wherein the encrypted programming credential comprises programming data, and wherein the encrypted mobile credential comprises virtual card data; an installer mobile application on a mobile device operable to communicate with the credential service, the installer mobile application operable to receive the encrypted programming credential and the encrypted mobile credential from the credential service, wherein the installer mobile application is operable to download the encrypted programming credential and the encrypted mobile credential from the credential service; and a credential module for an access control (16a, 16b,..., 16n), the credential module operable to extract the programming data from the encrypted programming credential, wherein the programming data is operable to set a lock encryption key and is usable to program the access control, wherein the mobile device is configured to send the encrypted programming credential to the credential module; wherein the mobile device is operable to: communicate the encrypted programming credential to the credential module to program the access control; and communicate the encrypted mobile credential to the credential module in the access control subsequent to communicating the programming data from the credential module to program the access control; and wherein the credential module is operable: to decrypt and validate the encrypted programming credential; to decrypt and extract the programming data, wherein the programming data is identical to a card meta-data physically encoded on a physical key card; to decrypt and validate the encrypted mobile credential; to extract the virtual card data from the encrypted mobile credential using the credential module; to communicate the virtual card data to operate the access control as a "virtual card read"; and to determine the validity of the programming credential independently from the mobile device. a credential service operable to generate an encrypted programming credential and an encrypted mobile credential, wherein the encrypted programming credential comprises programming data, and wherein the encrypted mobile credential comprises virtual card data; an installer mobile application on a mobile device operable to communicate with the credential service, the installer mobile application operable to receive the encrypted programming credential and the encrypted mobile credential from the credential service, wherein the installer mobile application is operable to download the encrypted programming credential and the encrypted mobile credential from the credential service; and a credential module for an access control (16a, 16b,..., 16n), the credential module operable to extract the programming data from the encrypted programming credential, wherein the programming data is operable to set a lock encryption key and is usable to program the access control, wherein the mobile device is configured to send the encrypted programming credential to the credential module; wherein the mobile device is operable to: communicate the encrypted programming credential to the credential module to program the access control; and communicate the encrypted mobile credential to the credential module in the access control subsequent to communicating the programming data from the credential module to program the access control; and wherein the credential module is operable: to decrypt and validate the encrypted programming credential; to decrypt and extract the programming data, wherein the programming data is identical to a card meta-data physically encoded on a physical key card; to decrypt and validate the encrypted mobile credential; to extract the virtual card data from the encrypted mobile credential using the credential module; to communicate the virtual card data to operate the access control as a "virtual card read"; and to determine the validity of the programming credential independently from the mobile device.