Short-Term Rental Access Control

Access control for short-term rentals means one thing: the right people get in at check-in, the wrong people don't, and you never drive across town at 10 PM to hand someone a key. That's the whole job description. Getting there takes more than buying a smart lock — it requires thinking through guest codes, cleaner codes, early arrivals, lockouts, battery failures, and what happens when a guest's phone is dead at 11:45 PM.

In Q1 2026, I had a lockout at my Columbus property that cost me $85 in locksmith fees on a $119/night stay. The guest arrived late, found the lockbox code had been changed during the previous turnover, and called me 14 times before I finally dispatched someone. That was the last physical lockbox I ever installed on any of my 12 properties.

Physical Keys vs. Smart Locks: The Real Math

A lot of hosts start with lockboxes because the upfront cost is zero. That math is wrong. Each key-related support incident — lockouts, lost keys, unauthorized copies floating around from past guests — runs $40–$150 in your time or a locksmith bill. Three incidents per year across a small portfolio costs $120–$450 before you count the 1-star "couldn't get in" reviews that drag down your search ranking.

Smart locks cost $100–$280 upfront. The Yale Assure Lock 2 (YDD40) runs $130–$150 at retail. The Schlage Encode Smart WiFi Deadbolt (BE489WB) is $180–$220. Both are WiFi-native — they connect directly to your router without a hub. Break-even on a typical listing is roughly 2–3 prevented incidents. Most hosts reach that within six months.

There's also the August Smart Lock Pro (AUG-SL-CON-S03), a retrofit that installs over your existing deadbolt without touching exterior hardware. About $150, installs in 10 minutes. Good for rentals where your lease restricts exterior hardware changes.

Why Auto-Rotating Codes Are Non-Negotiable

The most underrated risk in STR access control isn't a lockout — it's a guest who still has an active code after checkout. If someone checks out Sunday and their code works Tuesday, there's nothing stopping them from walking back in. I've had guests "forget" items and let themselves in without messaging me first. Twice. Neither time was a disaster, but both were entirely avoidable.

Auto-rotating codes fix this. Every reservation gets a unique 4–6 digit PIN that activates at your check-in time and deactivates at checkout. No reuse across guests. Cleaners get a separate permanent or rotatable code. Maintenance vendors get temporary time-limited access. The Vacation Rental Management Association lists automated access management as a baseline operational standard — and if you're running more than two properties, manual code rotation is a liability, not just an inconvenience.

How to Set Up STR Access Control Properly

1. Install a WiFi-enabled smart lock. Z-Wave locks require a hub (SmartThings, Hubitat, Home Assistant). WiFi-direct locks connect without one. For most STR hosts who don't already run a smart home hub, WiFi-native is simpler. Yale Assure 2 and Schlage Encode are the two I'd actually recommend — both have solid access code management APIs that STR software can hook into directly.
2. Create separate code slots for each user type. Guest code(s), cleaner code, owner or manager code, emergency vendor code. Never give your cleaner and your guest the same code. If you do and a guest arrives early, your cleaner either has to let them in mid-turnover or ignore the door.
3. Configure your check-in buffer. I use 4:00 PM check-in, 11:00 AM checkout. Guest codes activate at 2:00 PM and deactivate at 1:00 PM. That two-hour margin handles most early arrivals and slow checkouts without requiring any action from me.
4. Automate code delivery to guests. The code should arrive in a guest message the morning of their arrival, not when you happen to remember. Use a PMS messaging tool or an STR platform that fires code delivery automatically once the lock is paired to the booking.
5. Set a low-battery alert at 30%. Yale and Schlage batteries last 6–18 months depending on usage. A 30% alert gives you time to replace them during a scheduled turnover, not at midnight during a live stay.
6. Test the guest experience quarterly. Stand outside your own door, phone in hand, as if you just arrived after a 6-hour flight. Does the code work? Is it in the right message? Is that message clear? Run this check every 90 days minimum — it takes 10 minutes and catches problems before guests do.

Common Mistakes

Using the same code for consecutive guests. Creating a unique code per reservation is a single click. There is no operational reason to skip it. Hosts on BiggerPockets STR forums sometimes defend static codes because nothing bad has happened yet. That's survivorship bias. The incident just hasn't arrived.

Sending the code too early. Some hosts drop the access code the moment a booking is confirmed — weeks before arrival. A guest who received their code three weeks ago and decides to show up early at 6 AM is not going to message you first. Send codes 24 hours before check-in, not at booking confirmation.

No physical backup plan. Smart locks fail. WiFi goes down, batteries die, apps go unreachable. I keep a lockbox with a single physical key at every property as a true last resort. The code lives in my phone and my property manager's phone only, nowhere else. It gets used maybe twice per year across my entire portfolio.

Skipping firmware updates. Both Yale and Schlage push firmware updates periodically, and some include real security patches. If you haven't checked your lock firmware in 12 months, log into the app now.

How PMS Software Fits Into This

If you're using Hospitable ($29–$99/mo in 2026), their lock integration handles code generation and delivery for a handful of supported lock brands. It works for basic cases. Hostaway (custom pricing, roughly $125+/mo at the time of writing) does similar. Both are full channel managers, so you're paying for the entire platform whether or not you need every feature in it.

If you want to compare the full PMS landscape before committing, here's how the major STR PMS platforms stack up. And if Hospitable's pricing doesn't fit your portfolio size, there are capable alternatives at lower price points worth comparing.

Here's the honest limitation of this whole approach: it breaks down at commercial scale. Multi-unit buildings or properties with 8+ doors and shared access areas need a commercial access control system — Brivo, Salto, or Kisi — starting at $2,000+ installed. That's a different product category with different software, different installers, and different ongoing costs. For a portfolio under 30 total doors, individual smart locks with auto-code software is still the right call. Above that threshold, get a commercial access control quote before adding more individual locks.

How Koohost Handles Lock Automation

On Koohost, the lock lifecycle runs without any manual input after initial setup: guest code generated from the last 4 digits of their phone (random fallback when unavailable), activated 2 hours before check-in, deactivated after checkout. Cleaners get a separate permanent code. Battery warnings push to my phone at 30%. All of it fires automatically once a booking lands. Supports Yale Assure, Schlage Encode, and August locks.

The Pro Host plan — which includes full PMS API integration — is $30/mo. That covers lock automation, AI-drafted guest messages, and the rest of the platform. If you're already on STR management software and want to understand how lock automation fits into a broader stack, here's a closer look at the smart lock automation piece specifically.

If you want access control that runs without babysitting, try Koohost free for 30 days — no credit card.

FAQ

What is the most reliable smart lock for short-term rentals?

The Schlage Encode (BE489WB) and Yale Assure Lock 2 (YDD40) are the two I'd buy again. Both are WiFi-native with no hub required, both have access code management APIs that STR software connects to directly, and both carry ANSI Grade 2 residential security ratings. The Schlage has a slight durability edge in high-traffic rental environments based on feedback from other hosts I've compared notes with.

Can I use a smart lock without WiFi at the property?

Yes, with limits. Z-Wave locks work locally with a hub, and Bluetooth-only locks let you pre-load codes when you're physically nearby. The trade-off: no remote code rotation and no real-time lock status. For remote properties you don't visit regularly, WiFi connectivity at the lock is worth the extra cost.

What should I do when a guest says the code isn't working?

First: check the lock's status in your app — is it online and is the code listed as active? Second: have them re-enter slowly, one digit at a time. Fast entry on capacitive keypads sometimes misses a digit. Third: give them your physical lockbox code verbally. Don't leave a guest standing outside for 30 minutes. Check the lock's entry log afterward — most smart lock apps record every access attempt.

Do I need to disclose that my rental has a smart lock?

Yes, and many jurisdictions legally require disclosing electronic access devices. Beyond compliance, it sets the right expectation — guests who know they're getting a keypad code don't spend five minutes searching for a physical key. Add "keyless entry — code sent 24 hours before arrival" to your listing description.

What if the lock battery dies during a guest stay?

Both the Schlage Encode and Yale Assure 2 have a 9-volt battery override on the exterior — guests can touch a 9V battery to the contact terminals and the lock powers up long enough to accept the code. Tell this to your co-host or property manager. Keep a 9V battery in the welcome kit. It's a $1 solution to a midnight nightmare.

Should guests use the same code for every door at a property?

Yes. A uniform code across all doors at a given property for a given reservation is both easier to manage and simpler for guests to remember. Different codes for the front door versus the garage creates unnecessary confusion and support calls. One code per property per guest stay is the right default.