Property Management

How to Set Up Smart Lock Codes That Auto-Generate, Auto-Deliver, and Auto-Expire Per Booking

Manual code management takes 5-10 minutes per booking — at 50 bookings/month, 4-8 hours of pure overhead, plus the security risk of forgotten codes left active. Touch Stay 2023: 67% of guests want self-check-in. This guide walks through the standard manual workflow, the common solutions (Nuki, igloohome, TTLock, Yale, August, Schlage, plus PMS integrations from Hospitable, Hostaway, Smoobu, Lodgify and Operto/RemoteLock middleware), and what full automation requires.

Automated smart lock code management for vacation rental check-in and check-out

Auto-generate, deliver, and revoke lock codes per booking

Sign up free. Nowistay integrates with Nuki, igloohome, TTLock, Tedee and HomeIt — codes auto-generate at booking, deliver via welcome guide and AI co-host, and revoke at checkout. Zero host action.

Start free trial

How to set up smart lock codes that auto-generate, auto-deliver, and auto-expire per booking

A reliable smart-lock automation has five components: a unique access code generated for every booking (random or based on a guest detail), automatic delivery to the guest at the right time (welcome guide, automated message, AI co-host reply), an activation window tied to the booking dates, automatic revocation at checkout, and an audit log that shows when the code was used. Most hosts handle this manually — generate a code in the lock app, text it to the guest, hope to remember to remove it after checkout. It works for 1-2 properties. At 5+ properties the manual workflow becomes a security liability and a recurring time sink — and that is when hosts upgrade to a PMS with native lock integration or a dedicated access platform.

Why smart-lock automation matters more than it seems

Three reasons that show up consistently:

Guest experience and adoption

Smart-lock and self-check-in adoption is now mainstream. Lodgify's 2024 industry report found that 68% of hosts use smart locks and 74% always or frequently offer self-check-in. Transparent's 2023 Global Property Manager Survey reported that keyless entry adoption rose to 64% — the largest year-over-year tech adoption increase in the survey. Operto research adds that 48.2% of hospitality professionals say guests welcome contactless check-in and 35.3% say guests now expect it as standard. Touch Stay's 2023 guest communication study (2,024 vacation rental guests surveyed) puts the demand side at 67% of guests wanting self-check-in. A smart lock with an auto-delivered code is the simplest way to deliver that experience without coordinating physical key handoffs.

Security at scale

A code that doesn't get revoked at checkout is a security incident waiting to happen. Across 10 properties at 50 bookings a month, that is 500 codes generated annually. Forgetting to revoke even 5% means 25 codes still active at the end of the year. With one of them, a former guest can come back, a contractor can walk in, or a stolen device with the code in a text message can be used.

Operational time

Per booking: open the lock app, generate a code, copy it, paste it into a message to the guest, wait until checkout, log back into the app, revoke the code. Anecdotally 5-10 minutes per booking when done correctly. At 50 bookings a month, that is 4-8 hours of pure code management.

The real cost of doing this manually

Three failure modes recur in host forums:

Code sent to the wrong guest

The host has multiple bookings in the same week and accidentally sends Guest A's code to Guest B. Guest B arrives, the code doesn't work, and the host has to scramble to resolve it under time pressure.

Code not revoked at checkout

The host forgets to remove the code after the guest leaves. The next guest gets a different code, but the prior guest's code is still active. If the lock supports time-bounded codes (as most modern locks do), the issue is muted; if not, the prior guest can still enter.

Code sent too late

The guest arrives at 10 PM, hasn't received the code, and texts the host. The host is asleep. The guest waits at the door. The review reflects it.

What the standard manual workflow looks like

  1. A booking lands. The host receives a notification on Airbnb or Booking.com.
  2. The host opens the lock manufacturer's app (Nuki, igloohome, TTLock, August, Yale).
  3. Manually generate a code. Either pick a random 4-6 digit code or use the last digits of the guest's phone.
  4. Set an active window. Usually from check-in time to check-out time of that booking.
  5. Copy the code into a message to the guest, often via Airbnb messaging or WhatsApp.
  6. After checkout, log back into the app to revoke the code (or set the code to expire automatically if the lock supports it).

Every step is manual, and the host is the only person responsible for getting it right. At one property this is fine; at five it becomes a recurring source of mistakes.

Common solutions hosts use today

Lock manufacturer apps used directly

Nuki Web, igloohome dashboard, TTLock, August/Yale Home, Schlage, RemoteLock — every smart lock comes with its own app. They support generating temporary codes, but they don't know about your bookings. You manually generate the code and set the window for each booking.

PMS-native lock integrations

Most full PMS integrate with at least 2-3 lock brands. Hospitable supports Schlage, August, RemoteLock; Hostaway supports a wider range; Smoobu supports a small set; Lodgify offers integration via Operto. The integration depth varies — some only generate codes, others handle delivery, revocation, and code per booking. Always check which specific lock models are supported, not just the brand.

Dedicated access platforms (Operto, RemoteLock)

Specialist tools that focus exclusively on access management. Operto Connect and RemoteLock support a wide range of locks and integrate with major PMS as middleware. Strong choice if your PMS doesn't natively support your lock brand. Cost: typically USD 5-15 per door per month on top of your PMS.

Welcome guide tools (Touch Stay, Duve)

Welcome guide tools can display the access code dynamically once the host pastes it in. Useful for delivery but not for generation or revocation — the host still does that elsewhere.

Physical key boxes

Some hosts keep a key box at the property with a code that doesn't change. Cheap and reliable, but the code is shared across all guests over time, so it's a security weakness — anyone who has stayed has the code permanently.

Passing the lock app credentials to a co-host or VA

A workaround for portfolio hosts: give the lock app credentials to your co-host so they handle code generation. Works at small scale; creates security and accountability concerns at larger scale.

What full automation actually requires

To remove the host from per-booking code management, an automation has to do five things:

  1. Generate a unique code per booking automatically when a booking is created — no manual step.
  2. Set the activation window to match the booking's check-in and check-out times, including auto-update if those times change (early check-in, late check-out).
  3. Deliver the code to the guest at the right time and through the right channel — typically via the welcome guide URL and automated message, plus on-demand reply when the guest asks.
  4. Revoke the code automatically at checkout, no host action required.
  5. Log every code event (created, activated, used, revoked) for security auditability.

How Nowistay handles it

Nowistay integrates natively with five smart-lock providers: Nuki, igloohome, TTLock, Tedee, and HomeIt. When a booking lands, the system generates a unique 4-6 digit code (random by default, or configurable as the last digits of the guest's phone). The activation window is set automatically from check-in to check-out, including handling of negotiated early check-in or late check-out updates. The code is delivered through three paths: the welcome guide URL the guest receives in pre-arrival messages, an automated message at the configured time before arrival, and on-demand replies from the AI co-host when the guest asks "what's the code?". At checkout the code is revoked automatically. Every event is logged for audit. Cleaner codes are managed separately with a 4-hour active window per cleaning mission, so the cleaner has access exactly when needed and not before or after. Whether you reach this level of automation through Nowistay, an Operto integration plus your existing PMS, or by stitching together your lock app with a PMS that supports your specific lock model, the criteria above are the test for any setup.

Choosing a smart lock if you don't have one yet

Three considerations matter more than the brand:

  • PMS compatibility. Pick a lock your PMS supports natively rather than the most-marketed brand. The integration depth matters more than feature count.
  • Power source. Battery-powered locks (Nuki, TTLock, August) are easier to install but require battery changes every 6-12 months. Hard-wired locks (some Yale, igloohome) are more reliable but harder to install.
  • Backup access. Always have a physical key option for the host or maintenance team. Smart locks fail occasionally; physical keys do not.

Setting it up in 30 minutes

If you have a compatible lock and a PMS that supports it:

  1. Install the lock and connect it to its manufacturer cloud (Nuki Web, igloohome, etc.).
  2. In your PMS, connect the lock account via API or token.
  3. Map each property to its specific lock device.
  4. Configure the code-generation rule (random vs phone-based).
  5. Test by creating a fake booking and verifying the code generates.
  6. Test code delivery by triggering the pre-arrival message manually.
  7. Verify revocation by manually completing a test booking and checking the lock's code list.

Common edge cases worth handling explicitly

Late check-in extensions

A guest's flight is delayed and they message at 11 PM asking to check in at 1 AM. Your code's activation window was set to end at midnight. Two options: extend the window automatically when the negotiated check-in time changes, or fall back to manual code regeneration. PMS-native integrations typically handle the first; standalone lock apps require the second.

Cleaner access

The cleaning team needs lock access for the turnover window, separately from the guest. Best practice is a dedicated cleaner code with a 4-hour active window per cleaning mission, generated and revoked automatically. Avoid sharing a master code with the cleaning team — once given, it's permanent.

Maintenance and emergency access

Keep one or two long-lived codes for trusted maintenance staff, but rotate them every 90 days. The audit log shows whether they're being used in expected hours; rotation closes the risk if a code leaks.

Lock connectivity issues

Battery-powered locks occasionally lose Bluetooth or Wi-Fi connectivity. Always have a physical key backup at the property (in a separate lockbox with a master code that you rotate quarterly). Smart locks fail rarely, but when they do the cost is high.

Migrating from key handoffs to smart locks

If you're still using physical keys, the transition is straightforward but worth planning:

  1. Pick a lock model that's been in market for 3+ years (more reviews, fewer surprises). Nuki, igloohome, and TTLock all qualify.
  2. Order one lock and install it on a less-busy property as a pilot. Run a month of real bookings to validate.
  3. Train your cleaning team on the new code workflow before rolling out broadly.
  4. Roll out to remaining properties at one or two per week — the cleaning team adapts gradually.
  5. Update your listing photos and descriptions to highlight self-check-in, since 67% of guests want it (Touch Stay 2023).

Total transition timeline for a 10-property portfolio: typically 6-8 weeks. The investment per door is USD 150-300 for the lock plus installation, plus ongoing PMS or platform fees.

Stop forgetting to revoke codes after checkout

Sign up free. Every code event is logged with a timestamp; cleaner codes have a separate 4-hour active window. EUR 12/month per property after the trial.

Try Nowistay free

Bassel Abedi

Founder & CEO of Nowistay

Over 25 years of experience in real estate investing and a recognized expert in short-term rental automation. Bassel helps property managers increase revenue, cut operating costs, and deliver 5-star guest experiences using AI-powered tools he built from firsthand hosting experience.