Articles in this section

Use the Smoobu API: get an API key, set up webhooks, and sign your requests

  • Updated

Smoobu has an API so a tool or your own code can read and write your booking data, plus webhooks that tell your system the moment something changes. Your property content is available too, which is how an external website built on another platform can show your listings, descriptions, photos, amenities, beds, address, availability and prices without you retyping any of it. You manage all of it under Advanced > API Keys. Use it when a property tool needs access to your bookings or you are building your own integration. This is for advanced users only - Customer support can only help with integration issues related to marketplace partners. Our support team cannot help with custom developments.

Before you start

You need these before you can use the API:

  • A paid Smoobu account. Keys can't be generated on a free trial. If you're on a trial and need API access, contact Smoobu Support to have it switched on.
  • An understanding that every key gives full access to your whole account. Treat a key like a password.

Get an API key

  1. In Smoobu, open Advanced, then API Keys.
  2. Click Create New in the top-right corner.
  3. In the Create API token window, type a short name in Label (optional) so you recognise the key later, and click Submit.
  4. Smoobu shows Token created with your new key in the box labelled Label and your Secret below it. Copy both with the copy buttons and store them somewhere safe straight away, such as a password manager: Smoobu shows the secret only once. Tick I have copied my secret and click Close.
  5. The new key appears in the list with its label, and you can copy the key again at any time from the Key column. The secret cannot be shown again: if you lose it, revoke the key and create a new one. Paste the key and the secret into the tool or code that needs access.

Each key gives full access to your whole account, and there's no way to limit a key to only part of your data today. If you use more than one integration, create a separate key for each, so you can revoke one without breaking the others. To retire a key, click Revoke next to it: any request that still uses it stops working immediately.

Keep your key safe

A key is a password to your whole account, so handle it the way you would a password:

  • Never write a key directly into your code. That goes for API keys, passwords, and tokens alike: anyone who can see the code can see the key.
  • Store credentials in environment variables instead, for example in a .env file that your code reads at runtime.
  • Keep the .env file out of version control. Add .env and any other configuration file holding secrets to your .gitignore, so they are never pushed to GitHub.
  • Make your repositories private. If your integration code lives on GitHub, set the repository's visibility to Private immediately, especially when the code is your own proprietary work.

If a key does leak, revoke it on the API Keys page and create a new one; the leaked key stops working straight away.

Set up a webhook

A webhook tells your own system when something changes in Smoobu, so your system doesn't have to keep asking.

  1. On the API Keys page, find the Webhook URLs field.
  2. Enter the address on your server that should receive the updates.
  3. Click Save. You can add more than one webhook.

Smoobu sends a webhook for these events:

  • a new booking
  • an updated booking
  • a cancelled booking
  • an online check-in submission
  • a price element created
  • a price element updated
  • a price element deleted
  • a new message

That list is the complete set. There is no webhook for reviews, and there are no hidden or undocumented events.

That field holds only the webhooks you add yourself. Some marketplace partners register their own webhooks through Smoobu's API when you connect them, so you never have to paste a partner's address into this field.

For the exact data Smoobu sends with each event, open the developer documentation (docs.smoobu.com): on the API Keys page, click Click here for API documentation. The same docs hold the full endpoint reference and code examples.

Connect a marketplace tool instead

If the tool you want is already a Smoobu marketplace partner, for example a pricing tool or a check-in tool, you don't hand over a key at all. Just follow the guides in Smoobu Marketplace. You can disconnect Marketplace Partners at any time, which cuts off the partner's access immediately. This however might not end your subscription for the respective service. Use this path when it exists, and generate your own key only for a tool or script that isn't a listed partner.

Sign your requests with HMAC

Smoobu is moving direct API access to signed requests (HMAC), so each call proves it is genuine and unchanged. If you built your own integration, you need to add signing before 25 September 2026; after that date, unsigned requests are rejected. During the changeover both signed and unsigned requests work, so you can switch over and test without breaking your live setup.

Who needs to do something:

  • Marketplace partners (pricing tools, check-in tools, and the like): nothing to do, the partner handles it.
  • Channel connections (Airbnb, Booking.com, and other channels): not affected.
  • Your own script or integration that you control: add signing with the steps below.
  • A tool you don't control but pasted your key into: follow the steps below to enable signing. Then contact the external company and share your new API key and secret with them, so they can connect to Smoobu.

To set up signing:

  1. Create a key as described under Get an API key above. Every key you create there comes with a secret, shown once in the Token created window.
  2. Store the secret safely. If you lose it, create a new key and update your integration with the new key and secret before you revoke the old one, so your integration never stops working in between.
  3. Update your integration to sign every request. Alongside your key, each request sends four extra headers:
    1. X-API-Key (your key),
    2. X-Timestamp (the current time in UTC ISO 8601 format (example: 2026-04-01T12:00:00Z)),
    3. X-Nonce (a unique value you never reuse - use UUID v4 ),
    4. and X-Signature (the HMAC-SHA256 signature). How to build the signature, and the exact format of each header, is in the developer documentation: The full technical guide with code examples is available here: docs.smoobu.com/#hmac-authentication

Common problems

Create New is missing or does nothing

Key creation is switched off on free-trial accounts. If you're on a trial and need API access, contact Smoobu Support to have it turned on.

A partner tool gets your booking updates, but no webhook shows in Smoobu

Nothing is wrong and there is nothing for you to fix. When a marketplace partner registers a webhook on your behalf, Smoobu stores it separately from your own, and it stays hidden from that field. Your own webhooks are unaffected. If you disconnect the partner later, Smoobu removes their webhooks for you.

My signed requests fail with 401 Unauthorized

The signature or the timestamp is the usual cause. Common other causes:

  • Clock skew: your system time is off by more than 5 minutes. Make sure your server uses NTP.
  • Reused nonce: every request must have a unique X-Nonce (use UUID v4 or random bytes).
  • Wrong body hash: for GET and DELETE requests, hash an empty string, not null or undefined.
  • Query string order: sort the parameters alphabetically when you build the canonical string.
  • Encoding mismatch: sign the raw JSON body exactly as it is sent, with the same whitespace and encoding.

During the changeover you can fall back to unsigned requests while you fix it.

Still stuck?

If these steps didn't fix it, contact the Smoobu team: open the Help menu to open a ticket or book a call slot, or use the chat bubble in the bottom-right corner. To get the fastest answer, please include:

  • Your Smoobu User ID (in the profile-icon menu, top right).
  • The property name or ID, if it's about one property.
  • The Booking ID, if it's about one booking (Bookings, then View more).
  • The channel name, if it's about channel sync (Booking.com, Airbnb, Vrbo, and so on).
  • A short step-by-step: what you did, what you expected, and what happened.
  • Screenshots or a short screen recording of the problem.
  • Your browser and operating system, if something looks wrong on screen.

Related articles

Comments

0 comments

Please sign in to leave a comment.