Guest WiFi and Your PMS: How Reservation Login Works

TL;DR: Reservation login connects your guest WiFi to your PMS so the captive portal can check a booking before it grants internet access. The guest enters their room number and last name instead of a shared password, the portal queries the property management system over its API, confirms an active reservation exists, and opens the connection. Spotipo supports Cloudbeds and Zonal today, built as an extensible module, and setup is a configuration task rather than a development project.

Your property management system knows exactly who is staying with you tonight. It knows which room they're in, what name the booking is under, and when they check out.

Your guest WiFi knows none of this. It hands out the same password to everyone and has no idea who any of them are.

Those two systems have sat side by side in hotels for twenty years without talking to each other. PMS integration is what happens when they finally do, and it changes the guest WiFi login from a security hole into something tied to an actual reservation.

What a PMS actually is, and why WiFi never touched it

A property management system is the software a hotel runs on. Bookings, check-in and check-out, room assignment, folio and billing, housekeeping status. Cloudbeds, Opera, Mews, Apaleo, Little Hotelier and dozens of others compete in this space, and a property typically has exactly one.

The PMS is the source of truth for who is on the premises. Nothing else in the building holds that information as reliably.

Guest WiFi grew up entirely separately. It came from the networking side, sold by whoever installed the access points, and its job was to get people online rather than to know who they were. So it developed its own access mechanisms with no connection to the booking system twelve feet away at the front desk.

That gap is why almost every hotel still runs one of three flawed setups.

A shared password leaks the moment it's printed on a card, never expires, and grants access to everyone who has ever stayed with you.

Vouchers fix expiry and create labour. Someone generates them, someone hands them out, someone handles the guest who lost theirs at eleven at night.

Open access or a click-through page is fast and controls nothing, including the people in the car park.

None of them can distinguish a paying guest from a stranger, because none of them ever asked the system that knows.

How a captive portal talks to a property management system

The mechanics are simpler than they sound.

A captive portal already works by holding a device at a login page until some condition is met, then telling the router to let it through. If you want that redirect chain in detail, the plain English guide to captive portals walks through it.

PMS login is just a new condition attached to that same gate. Instead of checking an email address or a voucher code, the portal checks a reservation.

The guest enters their room number and the last name on the booking. The portal sends those details to the PMS through its API. The PMS answers whether an active reservation matches. If it does, the guest gets online. If it doesn't, they don't.

Two pieces of information rather than one is deliberate. A room number alone would be trivially guessable, since a stranger in the lobby could try 204 and get lucky. Pairing it with the name on the booking makes casual guessing impractical without adding any real friction, because both are things a genuine guest already knows without looking anything up.

That's the entire flow. No app to download, no code to collect, no card to find in a drawer.

Read access is the part worth checking

Any integration that touches your PMS deserves scrutiny, because that system runs your whole operation.

A WiFi integration should only ever request read access. The portal needs to ask whether a booking exists. It has no business creating reservations, modifying them, cancelling them or writing anything back.

In Spotipo's case the integration requests read scopes on Room, Reservation and Guest. That's the full extent of it. The portal can verify, and nothing else.

Credentials should also be scoped to a single property. A group connecting several hotels issues separate keys per location rather than one master credential across the estate, which limits the blast radius if a key is ever compromised. That fits the broader pattern of managing portals across multiple locations.

If a vendor asks for write access to your PMS to run guest WiFi, ask why.

What Spotipo supports today

Cloudbeds and Zonal, with the integration built as a module rather than a one-off connection, so further systems can be added.

That matters more than the current list. PMS integration is usually built as a bespoke project per system, which is why so few WiFi vendors offer it at all and why the ones that do tend to support exactly one. A generic module means the next system is an addition rather than a rebuild.

Setup is configuration, not development. For Cloudbeds you register an integration app inside your own account, set its type to Guest WiFi, generate an API key with read scopes on Room, Reservation and Guest, and pick the property it applies to. You then take your property ID from the Reservations URL, and paste both the key and the ID into your splash page settings under PMS Login. A status indicator confirms the connection.

The full Cloudbeds walkthrough has the click-by-click version with screenshots.

PMS login sits alongside the other login types rather than replacing them. Email capture, vouchers, paid access, SMS and the rest are all still configurable per site, so PMS verification is one option among the captive portal login methods available on your splash page.

What changes at a property that connects the two

The password stops being a liability. There's nothing to rotate, reprint or leak, because access is tied to a booking rather than to a string everyone shares.

Reception stops running a WiFi help desk. No codes to generate, none to hand out, and no lost-voucher conversations after the desk has gone quiet.

Login data becomes stay data. A connection tied to a reservation is more useful than a bare email address, because it can be lined up against the stay itself. That's the difference between a mailing list and something you can actually segment, which the guest WiFi revenue guide covers in more depth.

Nothing else about the splash page changes. Your branding, custom fields and post-login redirect to the restaurant menu or spa booking page all work exactly as before.

Frequently asked questions

What is a PMS integration for guest WiFi?

It's a connection between your captive portal and your property management system that lets the portal verify a guest's reservation before granting internet access. The guest logs in with their room number and the last name on the booking rather than a shared password.

Which PMS systems does Spotipo integrate with?

Cloudbeds and Zonal. The integration is built as an extensible module, so additional systems can be added rather than each one requiring a separate build.

Why do guests need to enter two details instead of one?

A room number on its own would be easy to guess from the lobby. Pairing it with the booking name makes that impractical while still only asking for things a real guest already knows.

Can the WiFi integration modify anything in my PMS?

It shouldn't, and in Spotipo's case it can't. The integration requests read-only scopes on Room, Reservation and Guest, so it can confirm a booking exists and nothing more.

Do I need a developer to set this up?

No. You generate an API key inside your own PMS account, copy your property ID, and paste both into your splash page settings. It's a configuration task.

Is this better than handing out a WiFi password?

For most hotels, yes. A shared password leaks immediately and never expires, so anyone who has ever been given it retains access indefinitely. Verifying against a live reservation means access reflects who is genuinely staying.

Does PMS login work with existing hotel hardware?

Yes. Spotipo runs on 30+ router and controller brands including UniFi, MikroTik, Cisco Meraki, TP-Link Omada, Aruba, Ruckus and Fortinet, with no firmware changes and no hardware replacement.

What about guests who aren't staying, like restaurant customers?

Login methods are configured per site, so how you handle non-resident visitors depends on how your property is set up. Worth working through your intended configuration in demo mode before guests encounter it.

Is PMS login GDPR compliant?

Spotipo hosts guest data in the EU and collects explicit consent, and a dedicated consent screen can appear before the login screen. As with any guest data, collect only what you'll use and document how long you keep it.

Connect your own property and watch it work

The convincing part isn't the explanation. It's seeing a real reservation in your own PMS unlock a real connection on your own splash page.

Set up a site, enable PMS login, add your API key and property ID, and run the flow in demo mode. You'll see exactly what a guest sees without touching the router or waiting for a check-in.

Start your free 14-day trial at spotipo.com and connect your property this week. The system that knows who's staying tonight and the system that lets them online should probably be talking to each other.