Guesty API

Guesty directly

# Get a token. You get five a day, so this must be cached.
curl -s -X POST 'https://open-api.guesty.com/oauth2/token' \
  -H 'Content-Type: application/json' \
  -d '{
    "grant_type": "client_credentials",
    "scope": "open-api",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

# Then read, with offset pagination.
curl -s 'https://open-api.guesty.com/v1/reservations?limit=100&skip=0' \
  -H 'Authorization: Bearer <token>'

# Then write the mapping, the token cache, the airbnb2 special case,
# and the calendar's separate base path. Then do it again for the
# next system your next client uses.

Through Repull

curl -s 'https://api.repull.dev/v1/reservations?limit=100' \
  -H 'Authorization: Bearer sk_live_YOUR_KEY'

# Guesty, Airbnb, Booking.com, Hostaway, Lodgify, OwnerRez, Smoobu,
# Beds24, iGMS and BookingSync come back from this one call.
# `platform` says where each reservation came from.

Every system authenticates differently

Guesty is OAuth2 client credentials with a five-token-a-day cap. Hospitable is a personal access token. Lodgify is an API key. Smoobu signs every request with an API key and secret (HMAC), and retires its old single keys on October 31, 2026. OwnerRez is basic auth or OAuth2. Beds24 is a refresh-token exchange. Hostaway is client credentials, and signs its webhooks with optional basic auth rather than an HMAC. Seven models across nine systems, each one a credential to store, refresh, rotate and explain to somebody’s security team.

Every system has its own trap, and you meet them one at a time

The five-token cap is Guesty’s. Lodgify’s messaging API is read-only, so you cannot reply through it at all. OwnerRez has no guest messaging API. None of these are in the documentation — you find them in production, usually on a Friday. We have already found them, which is most of what you are buying.

Some clients have no PMS at all

The next one may run on an Airbnb account and a spreadsheet. No amount of Guesty integration reaches them, and direct channel access cannot be bought — Airbnb approves software companies one product category at a time through a commercial and compliance review, and Booking.com designates connectivity partners. Neither is a signup form and neither is measured in days. Repull already holds that access, so one key covers a Guesty account and a direct Airbnb or Booking.com connection at once.

A PMS is not a route to a channel’s own features

Guesty passes through most of what you need from Airbnb — reservations, calendar, prices, messaging, review replies, booking requests and pre-approvals, listing content and photos. What it cannot pass through is anything that exists only in Airbnb’s protocol: the reservation alteration flow, special offers, reviewing a guest, permits and safety disclosures, the per-listing sync category that decides whether a write is accepted at all. Those are 36 Airbnb-specific endpoints on Repull, alongside the same unified read.

Does Guesty have a public API?

Yes. The Guesty Open API is a REST API at https://open-api.guesty.com/v1 covering listings, reservations, calendar, guests, messaging and webhooks. Any account holder with permission to manage integrations can create credentials from Settings → Integrations → Open API — there is no partner application to submit.

How do I get Guesty API credentials?

In Guesty, go to Settings → Integrations → Open API and create an application. You are issued a Client ID and Client Secret; the secret is shown once. Exchange them at https://open-api.guesty.com/oauth2/token with grant_type=client_credentials and scope=open-api for a bearer token.

Why is my Guesty token request failing?

Most often because you have used your five tokens for the day. Guesty caps token issuance at five per API key per 24 hours. If you request a token per API call rather than caching one, you exhaust the allowance almost immediately and every request after that fails until the window rolls. Cache the token across processes and refresh only near expiry.

What are the Guesty API rate limits?

The limit developers hit first is not on requests but on tokens: five per API key per 24 hours. Request limits apply on top and vary by endpoint and plan. In practice, treat a token as a shared resource rather than something you fetch per call.

Why do my Airbnb reservations not match on source?

Guesty labels Airbnb reservations source: "airbnb2", not "airbnb". Booking.com is "bookingcom". Code that branches on the obvious string sends every Airbnb booking down the fallback path without raising an error.

How long does a Guesty integration take to build?

Reading your first reservation is an afternoon. A production integration is longer: a shared token cache that respects the five-a-day cap, offset pagination that does not skip records mid-sync, the calendar on its separate base path, channel source values like "airbnb2", and webhook handling. Budget days rather than hours, then ongoing maintenance as payloads change.

Can I use Guesty and Repull together?

Yes. Repull connects to the same Open API you would call yourself, so nothing changes inside Guesty. You can read through Repull’s unified schema and still call Guesty directly for anything Guesty-specific.