Security Gateway
Security Gateway (SGW) on FCA / Stellantis — what it is and how access is detected
On 2018-and-newer FCA/Stellantis vehicles a Security Gateway controls write access to many modules. FCA PROXI Tool's role here is simple and honest: it detects the gateway status and warns you before a write if access is blocked, so you don't waste time on a write that will be rejected.
What the Security Gateway is
Introduced on 2018+ models, the Security Gateway (SGW) is an access-control module between the diagnostic port and the vehicle's internal networks. It governs whether write operations to certain modules are permitted. The official authorization path for gateway access is the manufacturer's AutoAuth program.
How FCA PROXI Tool detects gateway status
Before you attempt a write, the tool checks the gateway and tells you what it sees:
- Open — writes are permitted.
- Blocked — writes are not permitted in the current state; you are warned before you try.
- Present but removed from the configuration (
locked_unconfigured) — the gateway is physically on the car but absent from the configuration, a state that otherwise causes confusing silent failures.
Why writes get blocked — and telling SGW from a data error
A rejected write is not always the gateway. It can also be a configuration mismatch, a missing or unreachable target module, an adapter that is not CAN-FD-capable for an FD module, or a checksum problem. Run a diagnostic scan first: the tool confirms the module is present and decodes the rejection reason by parameter name, so you can tell a gateway block from a data error. See also the per-model SGW requirements pages.
Per-model SGW notes
Gateway behaviour and requirements vary by platform and model year. See the model pages: Grand Cherokee WL, Wagoneer / Grand Wagoneer, Wagoneer S, RAM 1500 DT 2025+, Dodge Hornet, Alfa Romeo Tonale and Maserati Grecale.
FAQ
Does FCA PROXI Tool remove or disable the Security Gateway?
No. It does not remove, disable or get around the gateway. It detects the gateway status and warns you when writes are blocked, including the case where the gateway is present on the car but removed from the configuration. The official authorization path is AutoAuth.
What does it mean if the gateway is present but not in the configuration?
That state (locked_unconfigured) means the gateway is physically installed but absent from the vehicle's configuration. The tool reports it so you understand why a write is blocked instead of seeing a silent failure.
How do I know if a blocked write is the gateway or a data error?
Run a diagnostic scan first. The tool confirms the target module is present and decodes the rejection reason by parameter name, which separates a gateway block from a configuration or checksum error.