Audi Key Programming: Complete Locksmith Guide (All Models)

Audi looks like one make and behaves like five. A customer rings about a lost key for an A4, and depending on the build year you are either reading a four-digit code out of an instrument cluster in ninety seconds or telling them the car needs a main dealer. Nothing on the outside of the car tells you which.

That spread is why Audi key programming catches people out. Ford moves through PATS generations in a reasonably orderly line. Audi changed where the immobiliser lives three times in twenty years — instrument cluster, then a module in the boot, then back to the cluster — and each move changed the job completely. The Audi vehicles in the Keysolved database cover eighteen model and year combinations across all of it, and the A4 and A3 are two of the ten most-looked-up vehicles on the platform.

This guide walks the five systems in order, with the procedure, the realistic job time and an honest note on where the aftermarket runs out. Identify the system before you quote. On Audi that single step is worth more than any tool in the van.

The five Audi immobiliser systems

Two things fall out of that table immediately. The transponder family changes four times, so a chip that works on one Audi is useless on the next — the transponder chip cross-reference chart covers which families clone and which must be enrolled. And the BCM2 era overlaps the MQB eras by years, so an A3 and an A4 sitting on the same forecourt in 2015 are completely different jobs.

IMMO III: the straightforward ones

The A4 B6 from 2001 to 2005 is as easy as Audi gets. The instrument cluster is the immobiliser master, it holds a four-digit Secret Key Code in its EEPROM, and it authenticates a Megamos Crypto ID48 transponder through the antenna ring on the ignition barrel. Up to eight key slots, and no separate body module in the authentication chain at all.

The catch is the cluster hardware. Early B6 production from 2001 to 2003 uses the Bosch RB4 cluster, which gives up the code over OBD in seconds. Later production may carry the Bosch RB8, which has stronger crypto protection and can make OBD extraction very slow or refuse it outright. When that happens the cluster comes out and the 93C56 or 93C66 EEPROM is read directly on a bench programmer. The code is also mirrored in the ECU EEPROM as a secondary source.

The matching procedure itself is well documented. Ross-Tech's reference for Immobilizer III key matching through the cluster puts it on address 17, adaptation channel 21, with the new value set to the total number of keys including the existing ones — old keys are cleared automatically, so every key must be matched in the same session. The cycling window is tight: all keys must be presented within sixty seconds of saving the adaptation, and the other keys must be kept away from the reader coil while each one is matched.

Add key, IMMO III. Identify the cluster at address 17, read the code over OBD, cut an HU66 blade, programme a virgin ID48, log in and set the total key count, then cycle each key through the ignition. Time: 20–30 minutes.

All keys lost, IMMO III. The same procedure without a working key. Set the key count to zero first to clear the lost keys, save, then enter the new count. Time: 30–45 minutes, or 60–90 if the cluster has to come out for a bench read.

The database rates both intermediate, which is fair — this is a job most locksmiths with a VAG-capable tool will finish on the driveway.

IMMO 4 and the precoding trap

The A4 B7 from 2005 to 2008 looks like the B6 and is not. Almost every B7 carries the fourth-generation Bosch RB8 cluster, and the RB8 introduced the single most expensive mistake on the whole Audi range.

On an RB8 there are two credentials, not one. There is a login PIN, returned by tools as a four-digit value and entered as five with a leading zero. And there is a separate twelve-byte component security value. The new ID48 must be precoded with that component security before the cluster will accept it. A plain unlocked chip appears to programme perfectly and then will not start the car. You will have a green tick on the tool, a customer watching, and a dead vehicle.

On the earliest RB4-clustered B7s a virgin unlocked ID48 goes straight in. So the first job on any B7 is reading address 17 and checking the component line: KOMBI+WFS 4 is the RB8 path and the chip needs precoding, KOMBI+WEGFAHRS. RB4 is the older path and it does not.

Two more B7 traps before you plug in. The 8E platform has no CAN gateway address, so a CAN-only interface will not raise the cluster at all — this car needs a K-line-capable lead, which is why tool menus label it "Bosch K-line IMMO". And the remote is a completely separate system living in address 46, the central convenience module, which holds four remote memory positions and knows nothing whatsoever about the immobiliser. Learn the transponder and the engine starts; the fob still does nothing.

Add key, RB8. Identify the cluster, save the 24C08 EEPROM, read the PIN and component security, cut and precode the ID48, log in, set the total key count, cycle the keys inside the sixty-second window, then programme the remote in address 46 channel 021. Time: 35–50 minutes for key and remote together.

All keys lost, RB8. Where the cluster gives up its data over K-line, budget 45–60 minutes. Where it refuses, the fallbacks are a bench read of the 24C08 cluster EEPROM or pulling the PIN from the engine ECU EEPROM — the 95040 in a Bosch ME7.x petrol unit, read in boot mode. Time: 90 minutes to two hours. The database rates B7 all keys lost as skilled rather than intermediate for exactly this reason.

Take two backups of any dump before you write. RB4 and RB8 boards are notorious for DEF errors, a 999999 km odometer and dead displays after a bad write, and recovery means a dump repair on top of the key job you were paid for.

The A1 8X sits in the same family with a different cluster again — NEC processor plus 24C64 EEPROM, on the PQ25 platform rather than MQB. Add key reads PIN and component security over OBD; all keys lost means removing the 24C64 and generating a service EEPROM, or service mode over OBD on tools that support it. Add key: 25–40 minutes. All keys lost: 60–90 minutes.

Immobiliser V: the BCM2 and the locked-module question

From 2008 Audi moved the immobiliser off the dashboard entirely. On the A4 B8 from 2008 to 2015 the master is the J393 Comfort System Central Control Module — the BCM2 — mounted in the right-hand side of the boot behind the side trim. The instrument cluster plays no part. Authentication is a PCF7945AC transponder challenge in Audi's own Hitag Extended mode, and the component security is split across the BCM2, the keys, the engine ECU, the gearbox ECU and, on cars built before roughly 2012, the electronic steering lock.

There is no PIN card and no dealer PIN lookup on any BCM2 car. The tool reads the component security from the module. Whether it can do that over the OBD port is the entire question, and it turns on one thing.

The split follows the BCM2 software version, not the registration year. Audi began shipping factory-locked modules around 2013, and the known locked A4, A5 and Q5 versions are 0711, 0650 and 0641, with 0633 appearing on some tool lists. But a 2013-registered A4 with an unlocked module still reads cleanly over the port, and a dealer software update can soft-lock an early one. Abrites' own guidance on locked and unlocked BCM2 modules is to read the status with the diagnostic software before deciding the route, and Xhorse publishes a comparable check for BCM2 encryption status on the Key Tool Plus. Read the version over OBD before you quote. Every time.

Add key, unlocked BCM2. Read the BCM2 data over OBD with the working key in the slot, save the file, make a dealer key from it, then enter the total key count and present each key — slot cars push into the dash slot, Advanced Key cars hold the back of the key to the start/stop coil. Time: 25–35 minutes, with the learn itself around five minutes on a 2009 to 2012 car.

All keys lost, unlocked BCM2. Wake the module the way the tool asks — headlights on, hazards on, brake held — then power-cycle the J393 before the read. Everything else is the same. Time: 40–60 minutes. Still rated intermediate.

All keys lost, locked BCM2. This is a bench job and it should be priced as one. The boot trim comes off, the J393 comes out, and the module is read on a stable twelve-volt supply with a solder-free adapter. Autel's own listing for the APB131 adapter covers the A4 from 2008 to 2016 along with the A5 and Q5, and states plainly that it must be driven by an XP400 or XP400 Pro on the IM608 or IM508 tablet lines. The alternatives are a Xhorse BCM2 adapter with VVDI Prog, Abrites' VN020 unlock with the ZN080 set, or Yanhua ACDP Module 29. Service data then goes back, the module is refitted, and the keys learn over OBD. Time: 2–3 hours, and the database rates it expert.

Price it properly, because the downside is real. An interrupted read or write can brick the J393, and the only way out is a donor module written with your backup or a new BCM2 fitted and adapted online through ODIS with GeKo access for component protection. Save every backup the tool offers, and do not touch power or cables mid-operation.

Version 0711 deserves its reputation. Most tools cannot add a key to a 0711 module even with a working key in hand. Abrites states its VN020 CS Manager as the route that handles 0711 for a spare key, having cracked a module that previously refused new keys outright. If you meet a 0711 and do not own that licence, the honest answer to the customer is that this one is not yours.

One more BCM2 trap that costs money rather than time. Frequency is set by the car's PR code, not the key style: PR 5D1 is 433.92 MHz, PR 5D7 is 868 MHz. Both turn up on UK cars. The A6 C7 is recorded in the database at 868 MHz as standard, where the A4 B8 is normally 433.92. Read the PR sticker in the spare-wheel well or the frequency printed on the J393 label before ordering. Three-plus-one button keys with a panic button are 315 MHz North American parts and will never work.

Note also that the PCF7945AC cannot be cloned. Every BCM2 key is written as a dealer key from the module data and then learned, and once learned it locks. A used Audi key needs renewing with a virgin-file write before it will take a second car, which is why renewable aftermarket boards are worth stocking.

MQB48: back to the cluster

The A3 8V from 2013 to 2020 moves the master logic back into the instrument cluster, now a Renesas NEC 35xx device, and switches the transponder to Megamos AES — the NCF29A1. A sixteen-byte component security value plus a six-digit secret key is shared across cluster, engine ECU, gearbox and, on KESSY cars, the electric steering lock. The same architecture runs under the Golf Mk7, so the Volkswagen guide is worth reading alongside this.

There is no onboard or DIY sequence anywhere on the 8V. Every key job needs a tool.

Add key, MQB48. The tool reads the component security from the cluster over OBD with one working key present, pre-codes the AES transponder and the 433.92 MHz remote together, and learns both in one step at the coil. Time: 20–30 minutes.

All keys lost, MQB48. The locked NEC35xx cluster generally cannot be read over the port. The cluster comes out, the MCU is read on the bench, the dump goes to the tool manufacturer's online server to calculate the sync, and the prepared dealer key learns over OBD after refitting. Time: 2–3 hours on a flip-key car. On a KESSY car you also need to read the engine ECU, gearbox and steering lock so the security values match, plus an ignition-forcing harness to wake a car with no key at all — 3–4 hours, rated expert.

Two ordering notes. Megamos AES runs through the entire 8V production run, so do not order a Hitag Pro or ID49 key for one. And the emergency blade is HU66 on most cars, but some 2015 and 2016-on cars carry the newer HU162T side-cut profile — check the blade in hand before you cut.

MQB49: where the aftermarket stops

The A3 8Y from 2020 is a different animal. MQB49 arrived across MQB Evo from late 2019, authenticating as UDS over CAN, with the secret held inside an RH850 crypto core rather than a serial memory chip. The transponder moves to Hitag Pro, the NCF2951, and the blade is HU162T.

The important point for pricing: there is a security code, it is always required, and it is recovered from the circuit board of a working key. Nothing to look up, no card, no sticker, no dealer number. The tool splits the original fob, reads the board on an adapter, and either returns the component security bytes or converts them into a one-shot service code.

Which means all keys lost on an 8Y has no aftermarket answer, because there is no board left to read. The database records this as a factory-only operation that normally means a new body control module plus keys ordered against the VIN. Independent coverage agrees — a January 2026 comparison of MQB48, MQB49 5C and 5D describes 5D programming as not widely supported by aftermarket tools and requiring an OEM key to make dealer keys. Tell the customer this on the phone, not on the driveway.

Add key, MQB49. Identify the board first: three lines of moulded symbols inside the shell is a 5C board, four lines is the later encrypted 5D. Read the original board on the adapter, write the new one, then learn in car with every key present. Keep other keys at least two metres from the car or the learn drops out, and keep the vehicle above 12.5 V throughout. Time: 60–90 minutes, rated skilled.

From model year 2025 the gateway must also be unlocked online before the immobiliser master will accept the write — two-factor sign-in, roughly ten extra minutes, and a token fee that varies widely by tool. On Comfort Key cars there is a further limitation to disclose: the factory fob talks to the car over ultra-wideband as well as 433 MHz, and no aftermarket board carries the ultra-wideband radio. Your key will lock, unlock and start on the button, but door-handle proximity will not come back.

Tool coverage, honestly

No single tool covers Audi end to end, and the gaps are not where the marketing suggests.

VVDI2 with the VAG fifth-immobiliser authorisation is the dependable workhorse across IMMO III, IMMO 4 and BCM2, and it gets into the RB8 cluster where tablet-style tools return only partial support. Paired with VVDI Prog it also handles locked BCM2 and MQB48 bench work. Two honest warnings from the database: writing immobiliser data back has been unreliable on some software versions, so treat your saved EEPROM as the safety net rather than assuming a write can be undone; and on MQB49 it is the Key Tool Plus, not VVDI2, that carries the read hardware.

The Autel MaxiIM IM608 Pro II has the broadest menu coverage, but read the fine print on the B7. Published coverage for the RB8 entry is partial over OBD, which means the XP400 Pro does more of the work than the tablet — and on locked BCM2 the plain XP400 is reported not to read encrypted modules at all. You need the Pro. Note too that Autel's encrypted-BCM2 function erases all keys and re-adds them, so bring every key the customer owns and treat a spare-key job as an all-keys-lost job.

The Lonsdor K518Pro is strong on IMMO III and IMMO 4 with no token fee on the older generations, and its ADP-40 solder-free kit is the safest way to read an MQB49 key board without putting an iron near the processor. Treat locked BCM2 all keys lost as bench work on it rather than a clean OBD job.

Abrites AVDI is the specialist answer rather than the generalist one. It is the route that unlocks locked BCM2 component security in situ without pulling the module, and the only documented route to a 0711 spare key. It needs licences, an active subscription and an internet connection, so it is not a casual purchase — but on the awkward Audis it is frequently the difference between the job and a tow.

Smart Pro remains a UK trade standard on the early BCM2 cars with the correct software pack, and it is worth being precise about which: ADS2323 is the Audi slot-key software, ADS2292 is the later UDS and MQB software. Its locked-module coverage from 2013 is not confirmed, and all keys lost on MQB AES is not its strength. Useful if you own one; not the tool to buy specifically for modern Audi. A fuller picture of where each tool earns its money sits in the 2026 key programmer coverage matrix.

Common pitfalls

The chip programmed and the car will not start. Almost always an RB8 cluster with an unprecoded ID48. The learn completes because the cluster accepted the transponder ID; the start fails because the chip does not carry the car's twelve-byte component security. Precode it and learn again.

The engine starts but the remote is dead. You learned the transponder and stopped. On IMMO III and IMMO 4 cars the remote lives in address 46, central convenience, as a separate operation — four remote slots against eight key slots. If a remote shows as recognised but will not operate the locks, resynchronise it: lock and unlock at the driver's door with the blade within thirty seconds, open the door, ignition on, remove the key, then press a button on the fob.

"Failed to enter programming mode" on a BCM2 car. That message is the diagnosis, not a fault. The module is locked. Stop trying over OBD and switch to the bench route, or hand the job to someone with the Abrites licence.

The customer's old key stopped working after you added one. Every Audi learn from IMMO III onwards requires the total key count and every key presented in the same session, and old keys are cleared automatically when you save. Anything left in a drawer at home is deleted. Ask how many keys exist before you start, and insist they are all brought to the car.

The cluster sticks showing L0 2-2. An interrupted learning session on an 8E has left the cluster in the learning state. Read the cluster EEPROM and change the state byte from 7 back to 6, then repeat the learn.

The new key is the wrong frequency. Read the PR code, not the model year. 5D1 is 433.92 MHz and 5D7 is 868 MHz, both sold in the UK, and the A6 C7 is commonly the 868 one.

You destroyed the customer's only MQB49 key. On the Xhorse MCU V1.1 loom the wire whose insulation is printed "RED" is physically purple. Wire by the printed label and the on-screen pinout, never by colour. The clock leads are deliberately short and must not be extended.

Frequently asked questions

How do I know whether an Audi BCM2 is locked or unlocked?

Read the module version over OBD before anything else. Known locked A4, A5 and Q5 versions are 0711, 0650 and 0641, with 0633 on some tool lists, and the version is also printed on the module label in the right-hand side of the boot. Do not use the registration year as the test — 2013-registered cars turn up with unlocked modules, and a dealer software update can soft-lock an early one.

Can you do all keys lost on an Audi A3 8Y?

Not through the aftermarket. The security code on MQB49 is recovered from the circuit board of a working key, so with every key gone there is nothing left to read. It becomes a factory operation, normally a new body control module plus keys ordered against the VIN with proof of ownership.

Why does my newly programmed Audi key start the car but not lock the doors?

On IMMO III and IMMO 4 Audis the remote is a separate system from the immobiliser, held in the central convenience module at address 46. Learning the transponder does not learn the remote. Programme it as a second operation, and note the car holds only four remote positions against eight key slots.

Does an Audi key need precoding?

On the fourth-generation RB8 instrument cluster, yes — the ID48 must carry the car's twelve-byte component security or it will learn and then refuse to start. On the earlier RB4 cluster a virgin unlocked ID48 is accepted as-is, and address 17 tells them apart. On BCM2 and MQB cars the question does not arise in the same form: every key is written as a dealer key from the module data.

Can Audi keys be cloned?

The Megamos Crypto ID48 on IMMO III and IMMO 4 cars is technically cloneable with a working key in hand, though programming a virgin ID48 over the socket is usually faster and more reliable. From the BCM2 era onwards the answer is no: the PCF7945AC cannot be cloned, and neither can the later AES and Hitag Pro chips. Every key is generated from module data and locks once learned.

Does SERMI help with Audi key programming in the UK?

Not currently. SERMI went live in the UK on 1 April 2026, giving accredited independent operators access to security-related functions including key programming and immobiliser data. But it is voluntary for manufacturers here rather than mandated as in the EU, and as reported at launch the Volkswagen Group brands have not signed up. For Audi work in the UK, the aftermarket route remains the route.

Before you quote

Audi rewards the locksmith who checks first and punishes the one who assumes. Three questions answer almost every Audi job before you leave the unit: which immobiliser system, which cluster or module version, and how many keys exist in total. Get those and the time estimate writes itself.

As with any key job, the paperwork comes before the tool: confirm ownership against the V5C and the customer's identification before you cut anything, and keep the record.

Where the car sits in that sequence is not guesswork. Look up the exact Audi model and year in the Keysolved database for the confirmed transponder, frequency, blade profile, security-code source and per-tool compatibility with field notes, and check the OBD port location guide if you are meeting a model you have not plugged into before. On an Audi, five minutes of lookup routinely saves two hours on the driveway.