Beds24 invite code: how to create one, which permissions to choose, and how to revoke access

What a Beds24 invite code is, and why apps ask for one

Apps that work with Beds24, such as guest messaging, cleaning schedules, accounting tools or a booking engine, need to read or change data in your account. Beds24’s API V2 gives them that access through an invite code: “To grant a third party access to your account, you will need to provide them with an invite code” (Beds24 API V2 documentation).

The app exchanges your code for its own keys, a token and a refresh token, and uses those from then on. Your Beds24 password never leaves your hands, and the app only gets what the code allows.

Some apps are not connected with a code but activated from the Beds24 marketplace, and older apps may still ask for an “API key” from Beds24’s previous API. Our guides to Beds24 integrations and to the Beds24 API cover both cases.

Never give an app your Beds24 password. Create an invite code in (SETTINGS) MARKETPLACE > API with only the permissions the app needs, and paste it into the app within 24 hours: each code works once.

How to generate an invite code

Beds24’s own instructions, in the order you will see them (Beds24 API V2 documentation):

1. Open the API page: in your Beds24 settings, go to (SETTINGS) MARKETPLACE > API, or use the direct link while logged in.
2. Click “Generate invite code” and select the scopes, in other words what the app may access and what it may do with it.
3. Decide on linked properties: whether the app may reach properties linked to your account, or only the properties in your account.
4. Optionally, whitelist IP addresses: if you add one, only that address can use the code. Leave the field empty unless the app gives you its addresses.
5. Click “Generate invite code” to create it. The code appears in the table on that page: copy it.
6. Paste it into the app straight away. The code expires after 24 hours and can be used once.

Some apps send you a link instead. It opens the same form with the scopes already ticked; according to Beds24, you then only decide on linked properties and click the button. Look at what is pre-ticked anyway: it tells you exactly what the app will be able to do.

No API menu in your settings? Beds24’s answer: “If the API menu is not visible in your account, contact support and we will enable it for you.”

Permissions (scopes): what to tick for which kind of app

Scopes decide what the app can see and change. Each one comes with a method: read, write, or all, which Beds24 describes as “a shortcut to grant access to all methods”. The scopes on offer (Beds24 API V2 documentation):

Then match the scopes to the job. As a rule of thumb, an app needs read access to what it shows you, and write access only to what it changes:

These are typical needs, not rules: follow the app’s own instructions, and ask why if it wants more. Some app pages on the Beds24 wiki simply ask you to tick every option under read and write (example); that works, but it opens everything, guest data and financial data included.

Linked properties are off by default: “Tokens do not provide access to linked properties and their bookings by default.” Tick “Allow linked properties” only if the app must reach properties linked to your account rather than created in it, which mostly concerns agencies and property managers. Beds24 adds that the link itself must be made under Account Management > Manage Account > Manage Property.

Scopes cannot be changed once the code exists: Beds24 says “you must create a new invite code with the scopes you want”. Ticking too few is easy to fix; ticking too many is easy to forget.

Why an invite code does not work: expired, already used, wrong permissions

Most failures come down to the first three rows, and the fix is always the same: generate a new invite code, check the scopes before you click, and paste it the same day. Beds24 does not let you extend a code or add scopes to it, so there is nothing to repair on an old one.

What happens after you paste the code

1. The app exchanges the code with Beds24 and receives a refresh token and a token (Beds24 API documentation). From then on, the code itself is spent.
2. The app works with short-lived tokens. Each one expires after 24 hours, and the app gets a new one with its refresh token, without asking you.
3. The refresh token stays valid as long as it is used. Beds24 lets it expire after 30 days without use, which is why an app left idle for over a month needs a new code.
4. Your choices stay as you made them: the same scopes, linked properties and IP whitelist, for as long as the connection lasts.

A careful app stores the refresh token encrypted on its servers and never shows it again. Beds24 also offers long life tokens, created on the same API page, but they only give read access: an app that writes bookings or prices needs an invite code. Developers will find the endpoints, credit limits and pitfalls in our Beds24 API V2 guide.

How to check and revoke an app’s access

Access given with an invite code can be withdrawn at any time in your Beds24 settings, without changing your password. Do it whenever you stop using an app, switch provider, or part ways with an agency.

1. Ask the app to disconnect first. The Beds24 API lets an app delete its own refresh token (Beds24 API documentation), so a well-built app can remove its access cleanly when you cancel.
2. Revoke the access in your Beds24 settings, so the app cannot reconnect without a new code. If you are unsure which access belongs to which app, Beds24 support, which is free for technical questions, can help.
3. Leave unused codes alone: they expire on their own after 24 hours.
4. Review the apps that remain once or twice a year: each one should be an app you still use, with scopes that still match its job.

Removing an app does not undo its work: bookings it created and prices it sent stay in Beds24. If you replace one tool with another, plan the switch so that two apps never write the same data, such as prices, at the same time.

An invite code gives an app its own access, separate from your login: you can withdraw it in your Beds24 settings at any time, and your password stays the same.

Example: connecting a booking page with an invite code

Here is the whole process with Bookpage24, a branded booking page that replaces the standard Beds24 booking page while Beds24 stays your PMS and channel manager:

1. Create a Bookpage24 account; no card is needed to sign up.
2. Generate an invite code in (SETTINGS) MARKETPLACE > API with three scopes, read and write: bookings, inventory and properties.
3. Paste it into the Bookpage24 dashboard within 24 hours. We exchange it once; the resulting token is encrypted on our side and never shown again.
4. Read the diagnosis. As soon as the property is connected, we test three 2-night stays for 2 adults, 30, 60 and 90 days ahead, and list the room types Beds24 cannot sell, with what to do for each.
5. Set up rooms and payments; the page goes live when your subscription is active. You can revoke the access in Beds24 at any time.

Why those three scopes? inventory lets the page read offers and availability live on every search, and check them again at booking time; properties gives it your room types; bookings lets it write each booking into Beds24 like any other, after which the Beds24 channel manager closes the room on Booking.com, Airbnb and your other channels. It asks for nothing more, and no card data ever passes through us: payments stay on the Beds24 payment page, with your own Stripe or PayPal.

Want to see it first? The live demo on the Beds24 booking engine home page shows a real hotel’s prices. Then Connect Beds24 – free diagnosis, or have our team set it up from an invite code and your photos. New to Beds24 itself? Start with our Beds24 tutorial.

Frequently asked questions