Guide

API keys and tokens

Every Room Profit module authenticates against the official Profitroom API using an API key you own and can revoke at any time. This is the reference we send hoteliers who ask "which scopes does this module need" and "how often should I rotate". Keep it near your operations runbook.

Where API keys live in Profitroom Suite

Profitroom Suite stores API applications under Property Settings, Integrations, API Access. Every application has a name, an environment (Production or Sandbox), a scope set, an IP allowlist, a rotation date and a status (Active, Revoked, Expired). The key value itself is shown once at creation and stored one-way hashed afterwards — you cannot read a key back; you can only issue a new one.

Minimum scopes per Room Profit module

We ask for the least scope that makes each module work. Here is the current map:

  • AutoPricer — Rates.Read, Rates.Write, Reservations.Read, Occupancy.Read.
  • Direct Booking widget — Inventory.Read, Rates.Read, Reservations.Write, Guests.Write.
  • WhatsApp Guest Messaging — Guests.Read, Reservations.Read, Communications.Send.
  • Ancillaries / Upsell — Reservations.Read, Reservations.Write, Products.Read, Products.Write.
  • Housekeeping — Rooms.Read, Rooms.Write, Reservations.Read.
  • VAT Invoicing — Reservations.Read, Guests.Read, Folios.Read.
  • Analytics — Reservations.Read, Rates.Read, Occupancy.Read, Compset.Read.
  • Multi-property Group Config — Group.Read, Properties.Read.

If a module needs a new scope after an update, we notify you inside the dashboard and give you a two-week window before enforcement.

One key per environment, per module family

Two patterns work well. Pattern A — one production key and one sandbox key covering everything you buy from us. Simpler to manage, wider blast radius if leaked. Pattern B — one key per module family: rates, guest communications, invoicing. Narrower blast radius. Slightly more paperwork on rotation. For a single property we recommend Pattern A. For a group with a dedicated IT function, Pattern B.

Rotation policy

Rotate production keys every 12 months at a minimum. Rotate on the day any admin-level Profitroom user leaves the property or the group. Rotate immediately if a key was ever posted in Slack, email or a ticket outside your controlled systems — assume the ticketing tool retains logs indefinitely.

The rotation flow is stock: create a new application in Profitroom Suite with the same scopes, paste the new key in the Room Profit dashboard, verify the handshake goes green, then revoke the old application. Room Profit modules read the new key on the next poll cycle, which for most modules is under 60 seconds.

IP allowlist

Every Profitroom application should carry an IP allowlist unless you have a very good reason otherwise. Room Profit publishes two static outbound IPs — the EU-Frankfurt primary and the EU-Warsaw failover — that must both be on the allowlist. We update this list at most once a year and always announce the change 30 days in advance in the dashboard and by email to your billing contact.

Never delete our IPs and forget to re-add them during a firewall migration; if you do, our modules will silently 403 for hours before you notice a stalled rate publish or missed WhatsApp message.

Sandbox versus production

Sandbox in Profitroom Suite is a shadow environment with a copy of your property structure, no live guests and no real inventory writes. Every Room Profit module recognises a sandbox key and displays a yellow banner in the dashboard to remind you that no messages, invoices or rates leave the sandbox. Use sandbox for the first two weeks of a rollout and for any staff training.

Revoking on staff turnover

An admin leaves the hotel. Do three things within one working day: revoke their Profitroom Suite login, revoke every API key they generated (visible in the audit trail), and rotate any key currently in production that they might have copied. Keep a short internal register — a shared secure note is fine — of who created which application and when. Our security review page details the same expectations.

Token expiry and refresh

Profitroom API keys themselves do not expire by time, but Profitroom Suite expires unused applications after 90 days of no successful API call. If you generate a key and only start using it three months later, it will fail. Generate the key at the moment you actually plug it in.

What Room Profit never asks for

We never ask for your Profitroom Suite login password, your KSeF qualified signature, your Meta Business Manager password, your Przelewy24 admin credentials, your PMS SQL credentials, or your KRS or NIP scanned documents unless you explicitly upload them to your own account settings. Anyone claiming to be from us and asking for those is not from us. Our support email domain is profit.dapokl.com — check the "from" address before you reply.

Auditing key usage

The Room Profit dashboard shows per-key call volume by module and by day. If you see a sudden spike from a module you did not enable, something is wrong — revoke that key immediately and ask us to investigate through the support channel.

Next steps

Open modules catalog Back to guides