Use the Smoobu API: get an API key, set up webhooks, and sign your requests

Smoobu has an API so a tool or your own code can read and write your booking data, plus webhooks that tell your system the moment something changes. Your property content is available too, which is how an external website built on another platform can show your listings, descriptions, photos, amenities, beds, address, availability and prices without you retyping any of it. You manage all of it under Advanced > API Keys. Use it when a property tool needs access to your bookings or you are building your own integration. This is for advanced users only - Customer support can only help with integration issues related to marketplace partners. Our support team cannot help with custom developments.

Before you start

You need these before you can use the API:

• A paid Smoobu account. Keys can't be generated on a free trial. If you're on a trial and need API access, contact Smoobu Support to have it switched on.
• An understanding that every key gives full access to your whole account. Treat a key like a password.

Get an API key

1. In Smoobu, open Advanced, then API Keys.
2. Click Generate API Key.
3. Copy the key and store it somewhere safe straight away, such as a password manager. Smoobu shows the key only once, so if you leave the page without saving it you'll have to generate a new one.
4. Paste the key into the tool or code that needs access.

Each key gives full access to your whole account, and there's no way to limit a key to only part of your data today. If you use more than one integration, generate a separate key for each, so you can revoke one without breaking the others. To retire a key, delete it on this page and the tool using it loses access straight away.

Keep your key safe

A key is a password to your whole account, so handle it the way you would a password:

• Never write a key directly into your code. That goes for API keys, passwords, and tokens alike: anyone who can see the code can see the key.
• Store credentials in environment variables instead, for example in a .env file that your code reads at runtime.
• Keep the .env file out of version control. Add .env and any other configuration file holding secrets to your .gitignore, so they are never pushed to GitHub.
• Make your repositories private. If your integration code lives on GitHub, set the repository's visibility to Private immediately, especially when the code is your own proprietary work.

If a key does leak, delete it on the API Keys page and generate a new one; the leaked key stops working straight away.

Set up a webhook

A webhook tells your own system when something changes in Smoobu, so your system doesn't have to keep asking.

1. On the API Keys page, find the Webhook URLs field.
2. Enter the address on your server that should receive the updates.
3. Click Save. You can add more than one webhook.

Smoobu sends a webhook for these events:

• a new booking
• an updated booking
• a cancelled booking
• an online check-in submission
• a price element created
• a price element updated
• a price element deleted
• a new message

That list is the complete set. There is no webhook for reviews, and there are no hidden or undocumented events.

For the exact data Smoobu sends with each event, open the developer documentation (docs.smoobu.com): on the API Keys page, click Click here for API documentation. The same docs hold the full endpoint reference and code examples.

Connect a marketplace tool instead

If the tool you want is already a Smoobu marketplace partner, for example a pricing tool or a check-in tool, you don't hand over a key at all. Just follow the guides in Smoobu Marketplace. You can disconnect Marketplace Partners at any time, which cuts off the partner's access immediately. This however might not end your subscription for the respective service. Use this path when it exists, and generate your own key only for a tool or script that isn't a listed partner.

Sign your requests with HMAC

Smoobu is moving direct API access to signed requests (HMAC), so each call proves it is genuine and unchanged. If you built your own integration, you need to add signing before 25 September 2026; after that date, unsigned requests are rejected. During the changeover both signed and unsigned requests work, so you can switch over and test without breaking your live setup.

Who needs to do something:

• Marketplace partners (pricing tools, check-in tools, and the like): nothing to do, the partner handles it.
• Channel connections (Airbnb, Booking.com, and other channels): not affected.
• Your own script or integration that you control: add signing with the steps below.
• A tool you don't control but pasted your key into: don't delete your key or migrate it yourself, that breaks the tool. Contact the Smoobu team, say which tool you use, and Smoobu sets the partner up. Your key keeps working during the changeover.

To set up signing:

1. Go to Advanced, then API Keys.
2. Click Create New, give the key a clear label, and click Submit.
3. Copy the secret straight away and store it safely. Smoobu shows it only once. If you lose it, use Regenerate Secret on this page, but regenerating cancels the old secret at once, so update your integration first.
4. Update your integration to sign every request. Alongside your key, each request sends four extra headers:
   1. X-API-Key (your key),
   2. X-Timestamp (the current time in UTC ISO 8601 format (example: 2026-04-01T12:00:00Z)),
   3. X-Nonce (a unique value you never reuse - use UUID v4 ),
   4. and X-Signature (the HMAC-SHA256 signature). How to build the signature, and the exact format of each header, is in the developer documentation: The full technical guide with code examples is available here: docs.smoobu.com/#hmac-authentication

Common problems

Generate API Key is missing or does nothing

Key generation is switched off on free-trial accounts. If you're on a trial and need API access, contact Smoobu Support to have it turned on.

My signed requests fail with 401 Unauthorized

The signature or the timestamp is the usual cause. Common other causes:

• Clock skew: your system time is off by more than 5 minutes. Make sure your server uses NTP.
• Reused nonce: every request must have a unique X-Nonce (use UUID v4 or random bytes).
• Wrong body hash: for GET and DELETE requests, hash an empty string, not null or undefined.
• Query string order: sort the parameters alphabetically when you build the canonical string.
• Encoding mismatch: sign the raw JSON body exactly as it is sent, with the same whitespace and encoding.

During the changeover you can fall back to unsigned requests while you fix it.

Related articles

• Smoobu for property managers

Still stuck?

If these steps didn't fix it, contact the Smoobu team: open the Help menu to open a ticket or book a call slot, or use the chat bubble in the bottom-right corner. To get the fastest answer, please include:

• Your Smoobu User ID (in the profile-icon menu, top right).
• The property name or ID, if it's about one property.
• The Booking ID, if it's about one booking (Bookings, then View more).
• The channel name, if it's about channel sync (Booking.com, Airbnb, Vrbo, and so on).
• A short step-by-step: what you did, what you expected, and what happened.
• Screenshots or a short screen recording of the problem.
• Your browser and operating system, if something looks wrong on screen.