DevelopersKeycard API
SELECT
16 Oct 2026

  • CLA = 0x00
  • INS = 0xA4
  • P1 = 0x04
  • P2 = 0x00
  • Data = the instance AID
  • Response = Application Info Template

Response Data format (4.0):

  • Tag 0xA4 = Application Info Template
  • Tag 0x02 = Application Version (2 bytes)
  • Tag 0x8C = Application Status (1 byte)
  • Tag 0x8E = Key UID (0 or 32 bytes)
  • Tag 0x8D = Capabilities (1 byte)
  • Tag 0x8A = Identity Certificate (98 bytes)

The SELECT command is documented in the ISO 7816-4 specifications and is used to select the application on the card, making it the active one. The data field is the AID of the application.

The response is the Application Info template which contains:

  • the application version number, formatted on two bytes. The first byte is the major version and the second is the minor version (e.g: version 2.1 is formatted as 0x0201). This number must match the version of the protocol implemented. Since 4.0 this is also how a client picks the secure channel version to use.
  • the application status byte, described below.
  • the Key UID, which can be either empty (when no key is loaded on card) or the SHA-256 hash of the master public key. Allows identifying the master key being used without revealing it.
  • the capabilities descriptor. Its value is the bitwise OR of all capabilities supported by the device. The capabilities are defined as:
    • Secure Channel: 0x01
    • Key management: 0x02
    • Credentials management: 0x04
    • NDEF: 0x08
    • Factory reset: 0x10
  • the card identity certificate, which the client verifies against its trusted CA anchors. Unlike 3.x, no separate command is needed to authenticate the card.

Introduced in 4.0, a single byte reports the card state in one round trip:

BitMeaning
0x10The card is initialized (PIN and PUK are set)
0x20A LEE seed is loaded (LEE mode)
0x0FRemaining PIN attempts, valid only when the initialized bit is set

Clients use the initialized bit to decide whether INIT is needed, without having to open a secure channel first.

Before 4.0 the response also carried an Instance UID (tag 0x8F), a secure channel public key (tag 0x80) and the number of remaining pairing slots. Those three fields are gone in 4.0 and clients must not rely on them. Clients that used the Instance UID to key per-card local state should migrate to the Key UID, or to the identity certificate public key for a card identifier stable across reinstalls.

The pre-initialized state was signalled differently before 4.0, by a bare public key instead of the template; since 4.0 the template is always returned and the initialized bit carries the information.

Last edited
16 Oct 2026