Online check-in and smart locks: a practical guide

Online check-in with a smart lock lets guests get into your holiday flat without meeting anyone: they enter their details and sign on their phone before arriving, and on arrival day they get a code that opens the door only for the length of their stay. For owners who live outside Spain, it is often the difference between relying on a neighbour with a spare key and running the flat from anywhere.

This guide explains how the whole setup works, which kinds of lock exist, why each booking should have its own code, what Spanish law expects regarding guest identification and which security habits to adopt.

How online check-in with a smart lock works

The usual flow has four steps:

1. A booking comes in from Airbnb, Booking.com, VRBO or your own website.
2. The guest checks in online: they get a link, enter the details of everyone staying (or scan their passport) and everyone aged 14 or over signs the entry form.
3. They receive access instructions: address, how to get into the building and their door code.
4. They come and go with the code, which stops working when the stay ends.

The key is linking steps 2 and 3: the code is only released once check-in is complete. That way nobody is inside your flat without you holding their details, and you can send the mandatory guest report to the Spanish police on time (see our guide to guest registration in SES.HOSPEDAJES).

Why it suits a holiday let

• Arrivals at any time, with nobody on standby.
• Lower cost and less coordination: no one has to wait at the door for every check-in, which matters if you are managing from another country.
• No spare keys going missing or ending up in a guest's pocket on the flight home.
• One code per booking: if a guest shares theirs, it stops working when their stay ends.
• Complete guest data before arrival, because the code depends on check-in.

There are downsides too: you depend on batteries and, with some models, an internet connection; some guests prefer a personal welcome; and not every door can take every lock.

Types of lock and access

Key safes

The cheapest option, with nothing fitted to the door itself. The drawback is that the code usually stays the same for everyone until someone changes it by hand, and the key may not make it back into the box. They work well as a backup, but they need discipline: change the code between stays and check the key is there.

Smart locks with a keypad

They fit over the door cylinder or replace the lock, and open with a keypad, an app or both. Models managed over the internet let you create codes with a start and end date and time, which is exactly what a holiday let needs. Two widespread ecosystems are:

• Nuki: locks fitted on the inside of the door, over the cylinder, with an external keypad (Keypad). To manage them remotely the lock must be online: through built-in Wi-Fi (Ultra, Pro and Go models, according to Nuki), Remote Access via Thread, or a Bridge on models without Wi-Fi.
• TTLock: a platform and app used by keypad locks from many manufacturers. To change or cancel codes remotely the lock needs a gateway connected to the internet.

On prices: they vary a lot by model, by whether you need a keypad or gateway and by the door. We do not list them here because they change often; check the manufacturer's website before buying.

Per-booking codes

A single code for everyone is convenient but risky: any previous guest could walk back in. The better approach is a different code for each booking, which:

• activates at check-in time on arrival day,
• expires at check-out time,
• updates if the booking dates change,
• and is deleted if the booking is cancelled.

You can do this by hand in the lock's app, but with several bookings a week it is easy to forget or get wrong. It is better left to your management software, driven by your bookings.

What about guest identification?

Self check-in does not exempt you from Spain's guest registration rules. Royal Decree 933/2021 requires you to collect the details of every guest, have everyone aged 14 or over sign the entry form, make sure the details match their identity document, and report them to the Ministry of the Interior's SES.HOSPEDAJES platform (in Catalonia, to the Mossos d'Esquadra; in the Basque Country, to the Ertzaintza) within 24 hours. This applies whether or not you live in Spain.

Online check-in takes care of this before arrival:

• Guests type their details or scan their passport or ID with the camera, which cuts typing errors.
• Each adult signs on their phone.
• The door code only appears once check-in is complete.

If you also want to check visually that the person arriving is who they claim to be (for example with a video call or a photo), remember the EU GDPR applies: collect only what you need, tell the guest and do not keep it longer than necessary. A photo of an ID document or a selfie with facial recognition is particularly sensitive data.

Good practice and security

• Never use the same code for everyone, or obvious codes (123456, 111111, a birth year).
• Check the batteries at every clean and keep spares in the flat. Many locks warn you in the app when they run low.
• Keep an emergency physical key somewhere safe (another key safe, a trusted neighbour, your cleaner).
• Check the connection: if the lock is offline, you cannot change or cancel codes remotely.
• Review the access log if something goes wrong.
• Send the code only through the guest's own channel (their stay page or the platform's messaging), never in a public listing.
• The building entrance is another door: if your block has a shared front door, think about how guests get in. Fitting anything to communal areas is a matter for the owners' association (comunidad de propietarios); see our guide to the Horizontal Property Act and holiday lets.
• Explain clearly how it works: a short text and a photo of the keypad prevent a lot of midnight calls.

How Apartop does it with Nuki and TTLock

Apartop integrates Nuki and TTLock locks on both the Free and Pro plans. You connect your account with the brand once, choose the lock for each flat, and from then on Apartop handles the codes itself:

• A different random 6-digit code for each booking, created on the lock 3 days before arrival (or when the booking comes in, if later).
• Valid from check-in time on arrival day until check-out time, in the flat's local time.
• It carries the guest's name and dates, so you can recognise it in the lock's app.
• If the dates change, it is updated; if the booking is cancelled or you switch locks, it is deleted. After check-out it is removed from the lock within 12 hours.
• Guests see it on their stay page only once check-in is complete and from arrival day.
• If the lock provider does not respond, Apartop retries with increasing pauses, and you have a button to generate the code straight away.
• Connection tokens are stored encrypted and never leave the server.

What you need for each brand:

• Nuki: a Nuki Keypad paired with the lock and an API token from Nuki Web.
• TTLock: a free developer application on the TTLock open platform and your TTLock app login. With a gateway, the code has exact times and can be changed or cancelled remotely. Without a gateway, the lock generates an offline period code: it works in whole hours, must be used for the first time within 24 hours of the start and cannot be cancelled remotely (it simply expires at the end).

If your flat has no smart lock, Apartop lets you record how guests get in: key handover in person, building reception, a key safe or a keypad lock, with your own instructions and photos.

All of this works together with online check-in with signature and the passport and ID scanner. See the plans on our pricing page or start for free, with up to 2 flats at no cost.

Sources

• Royal Decree 933/2021 of 26 October (BOE, in Spanish): articles 4 and 6 (accessed 11 Oct 2026)
• Nuki: official website (accessed 11 Oct 2026)
• Nuki help: remote access and Remote Access via Thread (accessed 11 Oct 2026)
• Nuki Web API: developer documentation (accessed 11 Oct 2026)
• TTLock Open Platform (accessed 11 Oct 2026)
• Spanish Data Protection Agency (AEPD)