Peugeot and Citroën Key Programming: Complete Locksmith Guide (All Models)

Peugeot and Citroën key programming is one job with two badges. The electrical architecture is shared, the immobiliser module is the same part family, the PIN comes from the same place and the key blade has been HU83 across both for twenty years. If you can programme a 208 you can programme a C3, and the menu path on your tablet usually puts them under one heading for exactly that reason.

That shared architecture is also what makes the make awkward. The module doing the work — the BSI, or Boîtier de Servitude Intelligent — was built by six different manufacturers across the production run, and which one is bolted behind the lower dash changes what your tool can do with it. Two cars of the same model year can behave differently. A 2016 car can be straightforward and a 2019 car of the same model can make you wait half an hour.

And then there are the three badge traps: the Peugeot that is a Toyota, the Peugeot that is a Fiat, and the newest Peugeot that is not a BSI car at all. Each one will waste your afternoon if you walk up to it expecting a PSA job. This guide covers the forty-four Peugeot and Citroën vehicles in the Keysolved database, era by era, with the procedure, the realistic time and an honest read on where the aftermarket stops.

One architecture, four eras

Everything below sits on the same idea: the BSI owns the immobiliser, holds the key list and gates programming behind a four-character security code. What changes across the eras is the transponder, the bus and how hard the module is to talk to.

Pre-BSI, roughly 1996 to 2001. The ECU manages authentication directly. On the Citroën Saxo the database records a Texas Instruments 4C fixed-code transponder read by the ignition barrel coil, with a Sagem or Siemens ECU doing the work and no separate BSI on early cars. From 1999 some variants moved to PCF7935, very early Hitag 2. The 4C chip clones. Base variants have no remote at all.

Hitag 2 BSI, roughly 2001 to 2015. The BSI arrives and becomes the immobiliser master. The Peugeot 307 is the reference car for this era and the one that introduced HU83 as the primary Peugeot blade. Early 307 uses PCF7936, later cars PCF7947, both Hitag 2 on 433 MHz, both with the BSI storing up to eight keys and talking to the engine ECU over CAN. Rolling code, so cloning is out and a code is in.

This era splits again at roughly 2005 and 2006, and the split matters more than the model year suggests. The Citroën C3 Mk1 is the best-documented example in the database. Early cars carry a Siemens BSI, unit codes BSI-E0x-00 and BSI-F0x-00, which is pre-CAN: diagnostics run over K-line at the socket with the PSA VAN multiplex behind it. From 2005 and 2006 the car moves to CAN with a Valeo BSI2004-P0x or a Johnson Controls BSI2004-H0x. On the pre-CAN cars the 16-pin socket frequently will not answer at all and you take the CAN pair off the engine ECU connector instead. An early-2006 car can be either. Check before you quote.

Hitag AES and Hitag Pro, roughly 2016 to 2021. The encryption moves to AES-128 and the chip becomes PCF7953M, then NCF29A1M on later production. The Citroën C3 third generation is the clearest example: Hitag Pro running in AES mode, PIN extracted automatically from the BSI over OBD by most professional tools, no manual entry required. These keys cannot be cloned. Every spare is an enrolment.

Locked BSI and VSM, 2021 onwards. This is where it gets expensive. Abrites classifies PSA modules as BSI unlocked up to 2021, BSI locked after 2021, and VSM locked after 2021, and the VSM cars are a different proposition entirely — more on that below.

The platform story underneath explains why the eras are so clean. Groupe PSA consolidated everything onto two architectures under its Push To Pass plan: CMP for the small cars and EMP2 for mid and high-end body styles, with EMP2 launched in 2013 and CMP arriving on the DS3 Crossback before spreading across all five brands. When you see EMP2 or CMP in a database record, that is the generation of BSI you are dealing with.

Identify the BSI before you touch the car

This is the step most people skip and it is the one that decides the job. Abrites lists the BSI families its PSA PIN Manager supports, and the list is the best available map of what is out there: Siemens K-Line and CAN, Johnson Controls CAN including 2015-onward units with the SPC microcontroller, Valeo CAN and UDS, Continental UDS including 2015-onward locked units, and Delphi CAN and UDS.

The practical consequences are these.

K-Line versus CAN changes the tool requirement. An older Siemens K-Line BSI and a Delphi UDS BSI are not the same conversation. The database records the Peugeot 208 second generation as CAN and UDS throughout with no K-Line types at all, which is why that car is straightforward on a current tool and a 2012 car sometimes is not.

Locked Continental and Johnson Controls units from 2015 need specific licence coverage. A tool that reads an unlocked BSI will not necessarily read a locked one.

Read the part-number label. On the Citroën C4 Picasso and C4 SpaceTourer the database is explicit: the BSI is supplied either as a Continental unit, for example BSI-Q04-01, or a Johnson Controls unit in the BSI04EV-K0x range, and you should identify which from the label behind the lower dash before you start. Two minutes with a torch beats twenty minutes of a tool refusing to connect.

The unit codes are your shortcut. Siemens units read BSI-E0x or BSI-F0x on the oldest cars, Valeo BSI2004-P0x and Johnson Controls BSI2004-H0x on the mid-2000s CAN cars, Continental BSI-Q04-01 and Johnson Controls BSI04EV-K0x on the 2010s cars, and Delphi EL3 — hardware designation D6 on later units — on the CMP cars. Several tools will auto-identify the BSI for you if the vehicle menu refuses to; on OBDSTAR the route is to select by immobiliser type rather than by vehicle and let the BSI auto-identify run.

Time: 5 minutes, and it is the best-spent five minutes of the job.

The PIN, and the four places it lives

Every BSI-era Peugeot and Citroën needs a security code before a key will enrol. On the modern cars this is a four-digit numeric PIN. On the older ones it is a four-character code that can contain letters, which catches people out on tools with a numeric-looking keypad — on the Advanced Diagnostics Smart Pro and AD100 Pro the keypad scrolls to letters with the left and right buttons, and if you did not know that you will conclude the code is wrong. There are four routes to it and they are not equally good.

1. The tool reads it over OBD. This is the normal route and on most cars it is automatic. The database records the C3 third generation PIN as extracted automatically with no manual entry, and a Lonsdor K518 pulling the PIN from a 2013 208 in a single ignition cycle. Time: seconds to two minutes on the modern cars, depending on BSI sub-type and tool. On the Mk1 C3 the database gives harder numbers: about five minutes with a working key, and fifteen to ninety minutes with no key at all. Quote the old cars accordingly.
2. The original card. Peugeot and Citroën supplied a card with the vehicle carrying the code — the confidential card on the older cars, the key card on the newer ones. Customers almost never still have it, but ask. It costs nothing and it occasionally saves the job.
3. The dealer, against the VIN. Available with proof of ownership. With SERMI live in the UK since 1 April 2026, the manufacturer route to security data now sits behind business-level accreditation and individual employee authorisation, with DBS checks and evidence of training. Aftermarket tools taking security access from the vehicle itself are unaffected, but if your plan was to lean on a dealer portal, that plan needs accreditation behind it.
4. The bench EEPROM read. The fallback when the BSI will not give the PIN over the port, or has locked itself. Expert work, dash out, priced accordingly.

Never guess the PIN. The database warns on multiple records that PSA BSIs lock after consecutive wrong attempts. A locked BSI turns a forty-minute job into a bench job, and you did it to yourself.

Add key, era by era

Pre-CAN and early CAN cars, roughly 2002 to 2006

The oldest BSI cars are the fiddliest and the least forgiving, and there is a specific procedure around the code read that nobody puts in writing. Using the Citroën C3 Mk1, where the database documents it tool by tool:

1. Find the port. On UK right-hand-drive Mk1 cars it is in the glovebox, alongside the cabin fuse box behind the fuse cover — not down by the driver's pedals and not in the engine bay. The Pluriel is the same and the 2005 facelift did not move it.
2. Fit a battery support unit and leave it on for the whole job. The code read runs for minutes with the ignition live.
3. Pull the wiper fuse. The tool drops the BSI into service mode for the read, and the wipers will sweep across a dry screen if you do not.
4. Press the hazard flasher and leave the hazards running through the code read. This is not superstition — the Autel tablets prompt for it explicitly, because it is what keeps the BSI awake through the read.
5. Read the code. If the BSI will not answer at the 16-pin socket you are on a pre-CAN Siemens car; take the CAN pair off the engine ECU connector instead.
6. Count the keys before you start the learn. On the Mk1 C3 the BSI holds a maximum of four keys and the learn is quantity-based — it rewrites the whole key list in one pass, so every key the customer wants to keep must be cut, chipped and in your hand.
7. Enter the code. Remember it may contain letters.
8. Ignition off, insert the key, ignition on within fifteen seconds. Repeat for each key.
9. Sync each remote: key in the ignition, ignition on, hold lock for five seconds.
10. Test the keys with a full minute between each one.
11. Time: 60–75 minutes with a working key. 90 minutes to two and a half hours on an all-keys-lost, because the code read alone can take ninety minutes.

If the customer has a working key and only wants a cheap spare that starts the car, there is a shortcut: the ID46 key on this generation clones. Read the original, run the 46 clone routine — which needs the car, because challenge data is collected through the ignition coil over a set number of ignition cycles — write to a programmable clone chip and cut a VA2 blade. Time: 20–30 minutes. Be straight with the customer about what they are buying: it starts and runs, it has no remote function, and it is no help whatsoever if the car later goes all-keys-lost.

Hitag 2 cars, 2001 to 2015

Using a Peugeot 307 as the pattern:

1. Connect to the OBD port — driver's side footwell, below and left of the steering column on this car.
2. Select Peugeot, then 307, then IMMO, then Add Key.
3. Present the working key to authenticate.
4. Insert the new HU83-cut key.
5. Follow the prompts to programme the transponder.
6. Sync the remote — lock and unlock held for three seconds, or through the tool.
7. Verify start, remote lock and unlock.
8. Time: 20–30 minutes on a car that behaves.

Hitag AES and Hitag Pro cars, 2016 to 2021

Using the Peugeot 3008 second generation, where the database records a Lonsdor K518 completing an add-key on a 2018 car in approximately three minutes with a working key present:

1. Connect to the OBD port. On the 3008 the lower plastic cover panel pulls downward by hand and the connector sits behind it, mounted vertically.
2. Switch the ignition on with the working key present.
3. Navigate to the make, the model, then Read PIN Code.
4. Let the tool read the four-digit BSI PIN. Do not type one.
5. Select Add Key and follow the prompts.
6. Present the virgin Hitag AES blank when asked.
7. Verify start, remote functions and, on keyless trims, proximity entry.
8. Time: 25–40 minutes including key cutting and the port hunt.

CMP cars, 2019 onwards

The Peugeot 208 second generation procedure is the same shape, with two differences worth knowing before you arrive.

First, the port. On UK right-hand-drive cars it is not under the steering column — it is in the passenger glovebox, behind a small plastic cover panel on the inner left wall that unclips by hand. The database explains why: the fuse box was not laterally mirrored for right-hand drive, so continental left-hand-drive cars keep the under-column position and UK cars do not. If you have spent ten minutes on your back in the driver's footwell of a CMP 208, this is the paragraph you needed.

Second, every trim is push-button start with no ignition barrel, so the database classes even the non-proximity key as a smart key. Time: 25–35 minutes.

The electric e-208 is worth a separate note. The database records it as sharing identical key hardware, OEM part numbers and BSI architecture with the petrol car, so the standard procedure applies. Abrites documents a second route on it: on the e-208 and the Opel Corsa F the PIN can also be read from the electric machine management ECU in a matter of seconds over OBD, either as part of the key-learning routine or directly from the module list. Useful to know when the BSI is being awkward on an EV.

All keys lost, and the thirty-minute wait

The good news on most of the range is that all keys lost is an OBD job. The database is explicit that bench work is not required on the CMP platform, and the same holds on the EMP2 cars and the P84 3008. The BSI gives up the PIN over the port and you enrol a virgin key.

The bad news is wait mode. From 2018 the BSI enters a timed wait after failed programming attempts, and the delay is real: Abrites states plainly that retrieving the PIN with its ZN094 emulator does not bypass the thirty-minute wait when learning a new key. Some tools skip it. Abrites lists wait-mode skipping on 2018-onward models as a function of its PSA licence, and the database confirms Lonsdor K518 wait-mode bypass on 2018-onward Delphi BSI. If your tool does not skip it, you are sitting in the car for half an hour and you need to have quoted for that.

The procedure, on an EMP2 or CMP car:

1. Connect to the port and put battery support on. The database flags 13.5 volts and above as the requirement on the CMP 208, and a voltage fault on PSA reports as a communication error rather than a voltage error.
2. Navigate to the model, then All Keys Lost.
3. Let the tool read the PIN.
4. If the BSI is in wait mode, either use a tool with a bypass or let the timer expire.
5. Prepare virgin Hitag AES blanks. These chips do not clone, so every key is an enrolment.
6. Present each key in turn. On the C4 Picasso and SpaceTourer the key goes in the emergency backup slot in the lower dash or armrest.
7. Programme every key the customer needs in this one session. All keys lost wipes the stored list, and on the C4 Picasso the maximum is five.
8. Sync each remote — ignition on, hold lock for approximately ten seconds — and verify start on every key.
9. Time: 60–90 minutes with no wait mode. Add 30 minutes if the BSI is waiting and your tool cannot skip it.

Note the key-erasure behaviour, because it catches people out on add-key too. On the C4 Picasso the database records that any key not presented during the session is erased from the BSI. If the customer has two working keys and hands you one, the other one stops working. Ask for all of them.

The three badge traps

The Peugeot that is a Toyota

The Peugeot 108 and the Citroën C1 have no PSA BSI anywhere in the key path. They are Toyota H-Immo cars, built alongside the Aygo at the TPCA plant in Kolín under the three-year joint project PSA and Toyota announced in December 2004 to produce three small European cars on a common platform.

What that means on the driveway:

• A standalone transponder key computer behind the instrument cluster owns authentication, with an NEC processor inside rather than plain serial memory. Bench work on that box is specialist, not clip-on-and-read.
• The transponder is a Texas Instruments DST-AES chip, catalogued as 8A, ID74 or simply the Toyota H chip. Blade is TOY48, not HU83.
• There is no PIN, no incode and no security card. A working key is its own authorisation.
• Central locking is a third separate module, a Valeo receiver holding a maximum of four remote codes, taught by an in-car door and ignition sequence that never touches the diagnostic socket.

That last point is the one that generates the call-back. You finish the transponder, the car starts, the buttons are dead, and you assume the job failed. It did not — the remote is a separate hand-learn. A Keysolved community tip on the C1 from Oliver's Car Keys and Diagnostics sets out the full thirteen-step sequence, ignition and door cycles included, with the whole thing to be completed inside two minutes.

The menu path trap is just as costly. On the Advanced Diagnostics Smart Pro this car lives inside the Toyota software pack alongside the Aygo and 108, not the Citroën software. On the Abrites AVDI it runs under Toyota, Lexus and Scion, and the database states flatly that the PSA package does not carry this car at all. Look under the badge on the bonnet and you will waste your first ten minutes.

Time: 40–60 minutes for an add-key with a working key, plus the remote learn. All keys lost is rated skilled and is an emulator or dashboard-out job — price it as one.

The Peugeot that is a Fiat

The Peugeot Boxer and its Citroën Relay twin sit on the X250 platform shared with the Fiat Ducato, built at the Sevel plant at Atessa under a Fiat and PSA light commercial vehicle joint venture that dates back to 1978 and put X250 into production in the second half of 2006. The database records Hitag 2, predominantly PCF7946 or PCF7947, on pre-2014 vans, moving to PCF7953 or NCF2951 Hitag Pro on the post-2014 facelift and the Stellantis-era vans. Two chips, two procedures, one model page — check the build year before you order a blank.

Add key on the Hitag 2 Boxer is rated intermediate and all keys lost intermediate. On the Hitag Pro van, all keys lost is rated expert, and the database notes that Stellantis-era vans from 2021 may require online server authentication. The same applies to the Peugeot Expert and the Citroën Berlingo third generation, both EMP2 vans running NCF2951 with all keys lost rated expert and Lonsdor coverage for 2021-onward Stellantis builds recorded as possibly limited. If you quote a lost-all on a 2022 Berlingo as a routine van job, you have mispriced it.

The newest cars, where the aftermarket actually stops

From 2021 PSA began fitting VSM in place of the BSI on cars such as the 308 third generation, the C5 X, the DS 4 second generation and the Astra L. This is a genuine change in what is possible.

Abrites announced an improved PSA PIN Manager on 13 October 2025 and the capability split is worth reading carefully. On 2021-onward BSI cars with Hitag AES keys the PIN is read directly in seconds, all keys lost included, without touching the BSI EEPROM or the engine ECU. On VSM cars from 2022 onwards the PIN is also read in seconds — but it requires either a working key or a VSM EEPROM dump.

Read that again, because it is the honest answer to the question locksmiths are actually asking. On a VSM car with genuinely no key at all, the aftermarket route today is a module dump, not a plug-in job. Anybody telling you a current 308 or C5 X all-keys-lost is a tablet-and-blank job is selling something. These vehicles are not yet in the Keysolved database, so treat the above as the manufacturer's own statement of its capability rather than a confirmed per-vehicle record, and verify on the car in front of you.

Tool compatibility

Coverage on PSA is unusually good across the mid-market, which is the one piece of genuinely cheerful news in this guide. The honest limits are below each tool.

Tier 1: tools that carry the whole range

Abrites AVDI — the deepest PSA coverage available and the only route listed against the 2021-onward locked modules. The PIN Manager licence reads from all BSI types, programmes keys over OBD, skips wait mode on 2018-onward cars and offers BSI exchange and ECU replacement functions. The ZN094 emulator gives an emergency start on an all-keys-lost car so it can be driven to a workshop. The cost is the honest problem: the database records the AMS subscription at approximately £1,200 per year for the full package, with the PSA licence on top. Verdict: buy it if PSA work is a meaningful share of your diary or if you are turning away Stellantis-era vans.

Lonsdor K518Pro — BSI PIN read over OBD with add-key and all keys lost across most PSA models, no per-vehicle token fee, and confirmed wait-mode bypass on 2018-onward Delphi BSI. The database records a single-ignition-cycle PIN read on a 2013 208 and a three-minute add-key on a 2018 3008. Where it falls short: coverage on 2021-onward Stellantis vans is recorded as possibly limited. Verdict: the best value on this make for volume work.

Autel MaxiIM IM608 Pro II — full PSA coverage with PIN read and key programming free of per-vehicle charge, which matters on a make you see weekly. The menu path is consistent: IMMO, then the make, then the model, then Read PIN Code, then Add Key. Needs the XP400 Pro for transponder work on several entries, and an active subscription is recommended on 2020-onward cars. Note the recorded gotcha on proximity keys: if keyless entry fails after programming, check the blank's EEPROM header bytes read 01. Verdict: the default if you already own one.

OBDSTAR X300 DP Plus — full PSA support across Continental and Delphi BSI with free PIN reading by OBD and no server charge, which is a real running-cost advantage on this make. The X300 Classic G3 and X300 Pro4 share the same PSA module. OBDSTAR also builds a dedicated PSA-only unit, the X300 Mini PSA, which the database records as explicitly covering the 208 2019 to 2024 for both blade and proximity keys; it does not currently have a page in the Keysolved tool catalogue, so verify the software version against your own unit.

Tier 2: capable, with gaps

Advanced Diagnostics Smart Pro — the ADS229 PSA PIN Code Read software covers Peugeot and Citroën from 2012 onwards, reading the PIN and programming the key in one OBD operation. It is also the shortest route on the 108 and C1, where the all-keys-lost application is rated to work with the alarm active. The limitation is the commercial model: approximately one token per vehicle on PSA, three on the Toyota-based cars, plus the ADS142 cable, and the security calculation runs on the manufacturer's server, so no data signal at the kerbside means no key.

IEA ZedFull — extracts the BSI PIN automatically over OBD and handles Peugeot and Citroën key and remote programming including Hitag AES. Carries the Toyota H application for the 108 and C1 separately. Coverage thins on the newest platforms.

Xhorse VVDI Key Tool Plus — PSA IMMO functions with PIN reading and key programming over OBD, and the advantage of generating and programming the key on one device. On the 108 and C1 it needs the Toyota 8A non-smart-key adapter, which the database records as limited to five attempts per day. Do not burn them experimenting.

Autel MaxiIM IM508S — PSA key programming supported, with the XP200 adapter required for transponder operations. Sensible as a second tablet.

Tier 3: the bench fallback

Scorpio-LK Tango — for the H-Immo 108 and C1 when every socket route has failed. Read the transponder key computer on the bench and write a blank LKP-04, which comes out as a master key. The database carries a specific warning: coverage of this box family has never been complete and there is at least one Aygo variant it will not take, so check the box revision before you strip a dashboard. On PSA BSI cars the equivalent fallback is an EEPROM read with a Xhorse VVDI Prog or an I/O-Terminal-class programmer to recover the precode from a locked BSI.

Common pitfalls

The remote works and the car will not start, or the reverse

On the Toyota-based 108 and C1 these are two separate modules and two separate jobs. On BSI cars they are one. If you are on a PSA car and the transponder took but the buttons are dead, sync the remote: ignition on, hold lock for approximately ten seconds. A Keysolved community tip on the C4 Picasso from Blake Warren notes that these remotes have a habit of de-syncing on both Peugeot and Citroën, so the sync step is worth running as routine rather than as a repair.

You ordered a Hitag 2 blank for a Hitag AES car

This is the commonest wasted journey on the make. The first-generation 208 ran Hitag 2 early and Hitag AES late; the second-generation CMP car launched with Hitag AES throughout and has no Hitag 2 phase at all. The database states it plainly: do not use a Hitag 2 or ID46 blank from the first-generation 208 on a CMP car, because programming will fail. Check the chip family on the specific year, not the model.

The proximity key programmes and the keyless entry does not work

This is a blank-sourcing problem, not a tool problem. On the CMP 208 the database records that the PCB chip marking must be A3M65 for full Keyless Go proximity entry. The A3M05 and A3M15 board variants will programme the transponder correctly and may still leave proximity detection dead. Confirm the marking when you buy, not when you are standing at the car.

You fitted a proximity blank to a non-proximity car

Also recorded on the CMP 208, and it fails quietly: the keyless function registers but the vehicle hardware for proximity detection is not there. The trim level decides the blank.

Blade profile confusion between HU83 and VA2

The database notes that several PSA keys are catalogued as VA2 in aftermarket listings and HU83 in others, and on the modern cars these are the same physical blade. On older cars they are genuinely different: the 206 and Saxo are VA2, the 307 onwards are HU83. On the C4 Picasso the database is emphatic that the emergency blade is the HU83 laser keyway and not the older flat VA2, and that they do not interchange despite the cross-listing. A community tip on the Berlingo from Sol raises the same ambiguity on that van and the honest answer is that it is year-dependent. Decode the lock or check the record; do not assume from a catalogue.

You guessed the PIN

Covered above and worth repeating because the consequence is severe. PSA BSIs lock after repeated wrong attempts and recovery is a bench EEPROM job. The related trap on the older cars is assuming the code is numeric: it is four characters and it can contain letters, and a tool with a numeric-looking keypad will still accept them if you know which buttons scroll the character set.

You left the wiper fuse in on an old BSI

On the pre-2010 cars the tool puts the BSI into service mode to read the code, which sweeps the wipers and runs the hazards. Pull the wiper fuse before you start and leave the hazards flashing deliberately — the hazard circuit is what keeps the BSI awake through a read that can run for minutes. Battery support stays on throughout. A dry screen scratched by a wiper blade is an avoidable bill.

You did not ask for every key

All keys lost wipes the list, and on several models an add-key session erases any key not presented. Count the customer's keys before you start the session, not after.

You treated a 2022 van as a routine job

Stellantis-era builds from 2021 may require online server authentication, and all keys lost on the Hitag Pro Expert, Berlingo and Boxer is rated expert in the database. Check coverage against the specific vehicle before you quote.

Frequently asked questions

Can you programme a Peugeot or Citroën key without the PIN code?

No. Every BSI-era car needs the security code before a key will enrol — four digits on the modern cars, four characters that may include letters on the older ones. The practical answer is that you almost never need to find it yourself, because the tool reads it from the BSI over OBD in seconds to a couple of minutes on most of the range. The code is also printed on the card supplied with the vehicle when new and available from the dealer against the VIN with proof of ownership.

Are Peugeot and Citroën keys the same?

Electrically, on most of the range, yes. Both makes run the same PSA BSI immobiliser, the same transponder families and the HU83 blade from the early 2000s onwards, and most tools file them under a single Peugeot, Citroën and DS heading. The exceptions are the Toyota-built 108 and C1, which share nothing with the rest of the range, and the Boxer and Relay vans, which sit on the Fiat Ducato platform.

Can a Peugeot or Citroën key be cloned?

Only the oldest ones. The Texas 4C chip on an early 206 or Saxo clones, and the ID46 Hitag 2 key on a 2013 to 2016 C4 Picasso clones to a Hitag 2 cloning chip for a quick spare. Everything from the Hitag AES and Hitag Pro era onwards cannot be cloned at all, so every spare key on a 2016-onward car is a full enrolment through the BSI. The transponder chip cross-reference chart sets out which chip families still copy and which have to be enrolled.

How long does all keys lost take on a Peugeot 208?

On the second-generation CMP car, allow 60 to 90 minutes. It is an OBD job and bench work is not required. Add 30 minutes if the BSI has entered wait mode and your tool cannot bypass it, and budget time for the port, which on UK right-hand-drive cars is inside the passenger glovebox rather than under the steering column.

Where is the OBD port on a Peugeot 208 or a Citroën C3?

They are in different places, which is the point. On the second-generation 208 the port is inside the passenger glovebox behind a small unclipping panel on the inner left wall on UK cars. On the third-generation C3 it is in the driver's footwell under the lower dash, left of the steering column, with no trim to remove. The Mk1 C3 is in the glovebox fuse box on right-hand drive, and the C3 Aircross is on the right of the column on right-hand drive. The OBD port location guide covers every make, and the per-vehicle record carries the access steps and an illustration.

Which tool is best for Peugeot and Citroën key programming?

For depth, including the 2021-onward locked modules, the Abrites AVDI with its PSA PIN Manager licence. For value on volume work, the Lonsdor K518Pro, which reads the BSI PIN over OBD with no per-vehicle fee and bypasses wait mode on 2018-onward Delphi units. If you already own an Autel IM608 Pro II or an OBDSTAR X300 DP Plus, both carry the range and neither charges per vehicle for the PIN read. The full coverage matrix counts confirmed coverage across every tool in the database.

Do I need SERMI accreditation to programme a Peugeot key?

Not for aftermarket tools. SERMI, live in the UK since 1 April 2026, gates the manufacturer route to security data and the OEM portals. Trade tools taking security access directly from the vehicle are unaffected. Accreditation matters if your workflow depends on dealer-supplied PINs or online precode sessions.

Before you quote

Peugeot and Citroën reward a locksmith who checks two things before leaving the van: the BSI type and the chip family on that specific year. Get both right and the make is some of the most profitable routine work available, because the PIN comes off the port, all keys lost is an OBD job on most of the range and the tool coverage is broad. Get either wrong and you are sitting in a car waiting out a thirty-minute timer with the wrong blank in your hand.

Keep the paperwork straight as well. Every procedure above assumes legitimate work: V5C or equivalent proof of ownership, photographic identification matching the keeper, and a record kept. Master Locksmiths Association members work to this as a condition of membership, and the expectation across the trade has hardened since SERMI went live.

Then look the car up. Search the Keysolved database for the exact Peugeot or Citroën model and year in front of you and you will get the key variants, the transponder, the frequency, the blade, the OBD port location with access steps, the add-key and all-keys-lost procedures, and the specific tools confirmed against that vehicle with the adapter and token requirements attached. For the warning-light jobs that turn out not to be key jobs at all, the immobiliser fault diagnosis guide works symptom to cause across six architectures.