How We Verify Data From Your Integrations
Most of what GuestsKey does is reacting to messages pushed to it: a booking was created, dates changed, a guest cancelled, a lock came online. Those messages drive real actions — creating door codes, rescheduling them, revoking them — so it matters that they genuinely came from your provider.
Signed messages
Each integration authenticates the messages it sends us, using the mechanism that provider supports:
- Seam (Wi-Fi locks) signs with an HMAC signature over the message body, verified before anything is processed.
- Stripe (billing) signs with its own signature scheme, verified with Stripe’s library.
- OwnerRez uses credentials on each request, compared in a way that doesn’t leak information through timing.
- Hospitable and Hospitable Connect sign with HMAC. Connect additionally refuses anything unsigned outright.
- Lodgify signs with HMAC.
A message that fails verification is rejected rather than processed.
Why this matters for your doors
A booking webhook is an instruction to change access. A forged one could create a working door code, move a check-in, or revoke a legitimate guest’s access. Verification is what stands between someone knowing a URL and someone opening your properties, which is why it happens before any processing rather than as a check along the way.
Connections that lapse
Provider connections expire or get revoked — a token times out, a password changes, a provider requires reauthorization. When that happens GuestsKey pauses automation for that connection rather than continuing on stale credentials, and tells you.
Existing codes already on your locks keep working; what stops is new codes and syncing changes. If a connection lapses, reconnect it from the Integrations section of your dashboard.
What we ask for
GuestsKey requests the access it needs to read your bookings and manage codes on your locks, and no more. Lock manufacturer credentials are entered on the provider’s own sign-in page during setup — GuestsKey never sees or stores your lock account password.