Settings

Integrations

← Back to Settings

Each tenant connects to external systems for booking, messaging, and access control. This page is the central place to verify each integration is healthy.

Hospitable (primary booking channel aggregator)

  • API key — Hospitable's API key for this tenant
  • Webhook URL — https://flatsbratislava.com/api/webhooks/hospitable/t/<slug> — paste into Hospitable's webhook config
  • HMAC secret — per-tenant secret used to verify webhook signatures (see #71)

Verify health: check Admin → Webhook Logs for recent inbounds from Hospitable. If you haven't received any in 24h, Hospitable's webhook may have been disabled.

WhatsApp Cloud API

  • whatsappPhoneNumberId — Meta-assigned phone-number ID. This field is the routing key; if NULL, every inbound webhook is silently rejected (#218).
  • whatsappBusinessAccountId — Meta WABA the number belongs to.
  • whatsappVerifyToken — per-tenant verify token Meta uses on the webhook handshake.
  • whatsappAccessToken (secret) — long-lived access token. Rotate per Meta guidance; coordinate with admin.

Webhook URL configured at Meta: https://flatsbratislava.com/api/webhooks/wa/t/<slug> (see Communications → WhatsApp Bot).

Verify health:

  • Webhook Logs — inbound rate is non-zero.
  • Send a test message to your tenant's WA number from a non-staff phone; it should appear in /v28/wa-comm within seconds.
  • Test outbound: from a reservation thread, send a free-text reply; verify delivery on the receiving phone.

Nuki

  • API token — per-tenant Nuki API token (admin-only, kept encrypted)
  • Per-property lock IDs configured under each property — see Properties → Smart Locks

Verify health:

  • Open any property's Smart Lock page; Active codes list should populate within a second or two.
  • Try issuing a manual maintenance code; verify it appears in the Nuki phone app for that lock.

2N intercom (optional)

For buildings with 2N IP intercoms:

  • Per-property 2N device ID configured under each property
  • Per-teammate 2N QR codes generated via the teammate editor — see Team & Access → Access Codes

Email (SMTP)

Per-tenant outbound email — see Tenant Configuration.

Beds24 (legacy)

For tenants migrating from Beds24, the integration is read-only and synced for historical reservations. Webhook URL: https://flatsbratislava.com/api/webhooks/beds24/t/<slug>.

Adding a new tenant

When onboarding a new tenant, the integration steps are:

  1. Create the tenant row (superadmin task).
  2. Configure Hospitable webhook → paste URL + HMAC secret.
  3. Configure WhatsApp Cloud API webhook → paste URL + verify token; populate whatsappPhoneNumberId in the tenant config.
  4. Configure Nuki API token; add lock IDs per property.
  5. (Optional) Configure 2N device IDs per property.
  6. (Optional) Configure SMTP for outbound email.
  7. Verify each integration via the Verify health steps above.
  8. Test end-to-end: simulate a booking via Hospitable → confirm tasks fire → guest receives check-in WA.
  • #218 — whatsappPhoneNumberId tenant field bootstrap.
  • #71 — webhook signature verification.
  • #80 — webhook payload trust boundary (tenant-spoofing removed).
  • #85 — .env.example and key rotation docs.
  • #72 — SSRF + outbound credential leakage (defence-in-depth, no operator-visible change).
Source: the FlatsBratislava operator manual.