How to give a shop access to your Tesla — and take it back
You have four options: leave an NFC key card, authorize a third-party app through Tesla’s own consent screen, turn on Valet Mode, or stay with the car. Only the app route is scoped, revocable from your phone, and visible to you afterwards.
Whatever you choose, know the exit before you choose it. Revocation lives in two places: your Tesla Account under Security > Third-Party Apps, and the car’s own Locks screen. Both are yours; neither belongs to the shop.
What are the real ways to give a shop access to a Tesla?
There are four: leave an NFC key card, authorize a third-party app through Tesla's own consent flow, turn on Valet Mode, or stay with the car. Only the second one is scoped, time-boxed, and revocable from your phone; the key card is the most common and the least accountable.
- Four ways to hand a Tesla to a shop
NFC key card
Full drive access, no expiry, no record
Nothing until you delete the card at the car
Third-party app authorization
Only the scopes you grant, only while granted
Revoke from your phone; access ends at pickup
Valet Mode
A speed-capped car with the frunk and glovebox locked
Your profiles and key list stay hidden
Stay with the car
Nothing — you are standing there
Everything, at the cost of your afternoon
In practice most shops still run on option one. If that is your visit, read what happens to your key card at the shop first — the card cannot be remotely wiped and leaves no per-card audit trail.
What does authorizing a third-party app actually grant?
Tesla's OAuth flow grants named scopes and nothing more: vehicle_device_data for vehicle data, vehicle_location for location and geofences, vehicle_cmds for commands, vehicle_charging_cmds for charging, and offline_access for refresh tokens. An app cannot escalate its own scopes — widening access requires the owner to grant again.
- vehicle_device_data — vehicle state and data.
- vehicle_location — required separately for any location or geofence feature. No location scope, no lot watch.
- vehicle_cmds — commands such as lock, unlock, trunk, and Valet.
- vehicle_charging_cmds — charging commands.
- offline_access — refresh tokens, so the app keeps working across the visit.
- An app cannot grant itself more. Widening scope requires you to authorize again.
Tesla documents the scope model in its authentication overview (developer.tesla.com). The practical read for an owner: look at the consent screen and check whether location is being requested. If a shop asks for location, ask what it is used for. The honest answer should be a geofence and after-hours movement, not a live map.
What is a Tesla virtual key and why does the shop need one?
Signed vehicle commands require the owner to add the app's virtual key to the car through a tesla.com/_ak/<domain> link or QR code. Tesla describes this as requiring a trusted user-in-the-loop, preventing even Tesla's backend from accessing these capabilities. In plain terms: a shop can never unilaterally instrument a customer's car.
Tesla’s virtual-keys developer guide states that signed commands require a trusted user-in-the-loop, “preventing even Tesla’s backend from accessing these capabilities” (developer.tesla.com). This is the structural fact that makes shop-side Tesla software honest: there is no path where a service writer instruments your car without you tapping approve.
How do I revoke a shop's access to my Tesla?
Two paths, either works. Go to your Tesla Account under Security > Third-Party Apps and revoke the app, or open the car's Locks screen and delete the app's virtual key. Revoking a scope also automatically removes any telemetry configuration that depended on it.
Revoke the app
- Open your Tesla Account and go to Security > Third-Party Apps.
- Find the app and revoke it. Dependent telemetry configurations are removed automatically when the scope they relied on is gone.
Remove the key from the car
- In the vehicle, open Controls > Locks.
- Delete the app's virtual key — same screen and same trash icon you would use to remove a phone key or an NFC card.
Both routes are documented in Tesla’s Fleet API FAQ (developer.tesla.com). Doing both is not paranoid; it is just thorough.
How long does an authorization last if I do nothing?
Tesla refresh tokens last three months, so an authorization you forget about does eventually lapse — but three months is far longer than a paint job. Access should end when the car leaves the lot, not when a token expires, which is why good custody software revokes at hand-back rather than waiting.
The shape above is the one to ask for: a window with two ends. A shop that can only turn access on has not thought about the second half of custody. See the limits we publish for what that means in practice.
Can I authorize before the appointment instead of at the counter?
Yes, if the shop supports pre-authorization. You approve the visit from home, the access stays dormant, it activates when the car reaches the shop, and it auto-revokes at pickup. It removes the awkward two minutes at the counter where a stranger asks you to log into your Tesla account on your own phone.
What if I do not want to authorize anything?
That is a legitimate choice and a shop should have a plan for it. Leave the key card, insist on written intake with photos and an odometer reading, and expect the visit record to say that no telemetry was collected. Any shop that pressures you into connecting an app is telling you something about the shop.
A good shop treats a decline as normal. It should still be able to tell you when your car arrived, who had the key, and what the odometer read at both ends — from paper if necessary. If you want the shop-side version of this argument, read what happens when a customer car is damaged at a shop.