API keys let other tools, such as pricing, check-in, smart lock, guest messaging and reporting apps, read and update your Hostify data. Give every tool its own key that can do only what that tool needs. If a key is ever exposed, you replace one key instead of all of them, and the exposed key cannot reach the rest of your account.
⚠️ The shared full-access API key (the legacy key) is deprecated and will be turned off on 31 December 2026. Move every integration to its own key before then. See Move off the legacy key below.
Where to find your API keys
Open the Developer Portal: go to Settings and click Open Developer Portal, or open app.hostify.com/developers.
Under API Access, click Manage Keys.
The API Key Management page lists every key on your account. For each key you see its status, when it was created and last used, and its scopes (what the key is allowed to do).
Keys are hidden by default. Click the eye icon to show a key, or the copy icon to copy it.
Only account administrators can show, copy, create, rotate or deactivate keys.
Keys that Hostify's own products use, such as Hostify AI and the booking engine, are managed automatically and are not listed.
Connect an integration with its own key
Most integrations have a ready-made key with exactly the access they need. You can create it in two ways.
From the integration's page
Go to Apps and open the integration.
Under Settings → API key, check the scopes the key will have and click Activate.
Copy the new key and paste it into the integration's own settings, in place of the key you used before. Then click Done.
From the API Key Management page
Click New API key.
In Template, scroll to Integrations and choose the integration.
The key name and scopes fill in automatically and cannot be changed. Click Create key.
Each integration can have one active key. It is the same key in both places, so you can manage it from either page.
Create a key for your own tool
Click New API key and enter a name that says where the key is used.
Choose a template (for example Full read only, Dynamic pricing, Finance & reporting or Owner accounting), or choose Custom and tick the scopes yourself.
Click Create key.
Choose the fewest scopes the tool needs. You can change a key's scopes later without changing the key itself.
Guest data
Reservations read returns reservations without the guest's personal details (name, email, phone, passport and similar). Tick Reservations read (incl. guest data) only when the tool needs to identify or contact the guest, for example for online check-in, door codes or guest messaging. The integrations that need guest data already include it in their key.
Rotate, deactivate and check usage
Rotate gives the key a new value. The old value stops working right away, so paste the new one into the integration immediately. Rotate a key whenever you think it may have been exposed.
Deactivate turns the key off. Use it for tools you no longer use.
View usage details shows the key's requests, errors, success rate and recent calls for the last 30 days.
If a tool reports the error API key scope cannot access this operation, the key is missing a scope. The error lists the scopes that would allow the request in required_scopes. Add one of them to the key, or contact us if it is an integration key.
Move off the legacy key
The legacy key gives full access to your whole account and stays the same until you refresh it. It is shown, hidden, on the Settings page and on the API Key Management page.
Make a list of the tools that use your legacy key.
For each one, activate its own key (or create a scoped key) as described above and replace the key in that tool.
When every tool has its own key, click Disable legacy key on the API Key Management page.
After 31 December 2026 the legacy key stops working for every account.
Keep your keys safe
Paste keys into the integration's own settings wherever you can. If a partner asks you to send a key by email, send that partner's own key, never the legacy key, and do not put keys in chats or shared documents.
Use one key per tool, so you can rotate or turn off one tool without affecting the others.
Rotate a key if it may have been exposed, and deactivate keys you no longer use.