To use the ThinkReservations API, you create a Restricted API Key in your account and share it with whoever is building your integration. This article covers how to create a key, choose its scope, keep it secure, and revoke it.

If you're not yet sure whether the API is right for you, start with The ThinkReservations API article.

You need the "Can manage API keys" user permission. Account owners have this already. If you're not an account owner, someone who can edit user settings can grant you access.

This permission controls both creating keys and viewing existing ones. If you don't see an API Keys page in your settings, this permission is most likely the reason. Your account owner can grant it to you.

Because an API key can read your reservations and potentially your guest contact details, we recommend granting this permission only to the people who would actually be arranging a developer connection rather than granting it broadly.

Copy the key somewhere safe when you create it, and treat it like a password from that point forward.

There is currently no limit to the number of keys that you can create.

Access is broken into individual permissions, called Scopes. You grant each one separately. Your key only carries what you select when you create it.

Grant only what the integration needs. If your developer is building an occupancy report, it doesn't need permission to update your rates. If it's building a revenue summary, it probably doesn't need guest email addresses. Ask your developer which permissions they actually require, rather than granting everything.

Guest contact details deserve particular thought. This permission covers guest name, email, phone, company, address, and notes. Without it, your reservations still come through; they just don't include the guest's contact record.

See the privacy section in The ThinkReservations API for what this does and doesn't hide.

Permissions are fixed once the key is created. You can't edit them afterward. To change what a key can access, create a new key with the permissions you want, point the integration at the new key, and delete the old one. There's no limit on how many keys you can create, so this is routine rather than a workaround.

Your developer will need your property's Hotel ID. It's displayed alongside your key on the Settings → API Keys page.

Each key works with a single property. If you manage several properties, you'll need to create a key in each one. Keys are property-specific. Meaning, a key from one property can't reach another property's data.

An API key is a credential, like a password. Anyone who has it can read whatever data the key's permissions allow. Treat it accordingly:

Create one key per purpose. If you have two separate uses, a reporting script and a developer's project, for example, create two keys rather than sharing one. That way, you can shut off one without breaking the other. Since keys are unlimited, there's no reason to share.

Delete the key at Settings → API Keys. Any user with the "Can manage API keys" permission can do this.

Deletion takes effect immediately. Whatever was using that key stops working right away. There's no waiting period, and nothing we need to do on our end. If you're ending a relationship with a developer or vendor who has your key, deleting it instantly cuts off their access.

Because the cutoff is immediate, make sure you know what's relying on a key before deleting it, or you may interrupt a report or connection you still want to keep.

API keys are not automatically deactivated when an account closes. If you're closing your ThinkReservations account, we recommend deleting your API keys as part of wrapping up, particularly if a developer or third party was using one.

Occasionally, a technology company will ask you to create an API key and share it with them so they can connect their product to ThinkReservations.

It's your account and your decision, but a few things are worth knowing before you do:

If a vendor is interested in becoming an official ThinkReservations integration partner, we'd like to hear from them directly. Ask them to email product@thinkreservations.com.

I don't see an API Keys page in my settings. You most likely don't have the "Can manage API keys" permission. Account owners have it by default and can grant it to other users. This permission also controls viewing existing keys, so without it the page won't appear at all.

My developer says a request is being rejected. If it's a request for a list of properties or data from multiple properties, that's expected. Restricted API Keys can't use that request, and don't need to. Your unique Hotel ID is displayed on the Settings → API Keys page.

Guest email addresses aren't appearing in the results. The key wasn't granted permission to access the guest contact details. Because permissions are fixed at creation, you'll need to create a new key with that permission selected and delete the old one.

I need to change what my key can access. Permissions can't be edited after a key is created. Create a new key with the permissions you need, switch the integration over, then delete the old key.

Something that was working has stopped. Check to see that the key hasn't been deleted. If you still need help, reach out to support to see if there is a known issue with the API.

Can I see whether my key has been used? Yes. There is a "Last used" column within the API Keys page in your ThinkReservations account's Settings menu.

Additional Resources: The API Documentation created by our development team is very robust and will be your go-to resource for any additional questions.

Our support is limited to the documentation resources below: