Connecting a hotel door lock system to your Property Management System eliminates physical key-encoding terminals, automates guest access, and creates a single source of truth for room status. This guide covers the integration architecture for the four PMS platforms most commonly used by independent and mid-scale hotels.
How Hotel PMS–Lock Integration Works
The architecture has three layers:
- PMS — holds reservation data (guest, room, check-in/check-out datetime)
- Lock management middleware — receives reservation events from PMS via API; programs lock credentials (RFID card or BLE key) valid for the exact stay window
- Lock hardware — executes the credential; logs access events; reports battery and door status back up the chain
The critical point: no physical key-encoding station is needed. The middleware programs the Mifare DESFire EV2 RFID card wirelessly via the front-desk encoder, or issues a BLE digital key directly to the guest's smartphone. The guest's access automatically expires at check-out time — no manual revocation required.
Opera Cloud / OHIP Integration
OHIP is Oracle's open API platform for Opera Cloud. It provides REST APIs for property configuration, reservations, rooms, and business events. Lock integrations use two primary API families:
- Business Events API: Subscribe to events — ReservationCheckIn, ReservationCheckOut, RoomChange. When a guest checks in, OHIP pushes the event to the lock middleware webhook in real time.
- Reservations API: Pull reservation details (room number, stay dates, guest name, special access requirements).
- Room Management API: Push room status updates (door open/closed, lock tamper alert) back to Opera housekeeping view.
Integration timeline: 2–4 weeks from OHIP sandbox access to go-live. Trudian provides the middleware and handles the OHIP certification process. Hotel IT team needs to provide sandbox credentials and confirm room type configuration.
Mews Connector Integration
Mews provides the Connector API with websocket-based real-time event streaming. This is one of the cleaner integration architectures in the hotel PMS market.
- Websocket connection streams reservation events (created, updated, cancelled) and service order events
- The lock middleware subscribes to the
ReservationUpdatedevent and extracts start/end datetime, room number, and guest identifier - BLE mobile key can be issued to the guest's email address — Mews Guest Portal triggers the key delivery workflow
- Lock status (battery, door state) exposed in Mews Housekeeping module via the Resource Block API
Integration timeline: 1–3 weeks. Mews Connector API is well-documented and the webhook architecture is straightforward. This is typically the fastest PMS integration to implement.
Cloudbeds Integration
Cloudbeds uses a REST API with OAuth 2.0. It is the most common PMS among independent boutique hotels and small chains globally. Integration uses:
- Reservation webhooks:
reservation.created,reservation.updated,reservation.checked_in,reservation.checked_out - The middleware processes
reservation.checked_into activate the key andreservation.checked_outto invalidate it - Room assignment confirmed via the
GET /roomsendpoint before key programming
Limitation: Cloudbeds does not have a native mobile key delivery flow — the lock middleware must handle the BLE key email/SMS delivery independently. This adds one component to the stack but is straightforward to implement.
Apaleo Integration
Apaleo is a modern cloud PMS with one of the strongest open API designs in the market. It uses an event-driven architecture with a subscription model (AMQP message bus). Lock integrations:
- Subscribe to
Reservation/CheckedInandReservation/CheckedOutevents via the Apaleo Notification API - Apaleo's Property Management API provides the full reservation object including room number and stay times
- Apaleo's open marketplace (Apaleo Store) means lock integrations can be published as marketplace apps — lowering the integration barrier for hotels already using Apaleo
Integration timeline: 2–3 weeks. Apaleo's API documentation is excellent. Recommended for tech-forward hotels looking for a future-proof PMS architecture.
Key Lifecycle: Check-In to Check-Out
BLE Mobile Key vs RFID Card
Both credentials work with the HL-500. The choice depends on your guest profile:
- RFID card (Mifare DESFire EV2): No guest app required. Works for all guests regardless of smartphone type or tech literacy. Requires a front-desk encoder terminal (included in the Trudian hotel package).
- BLE mobile key: Delivered to guest's smartphone before arrival. Enables true self-check-in and bypass of the front desk. Requires the hotel's branded app (or Tuya Smart Life app) installed on the guest's phone. Best suited for tech-forward boutique hotels or extended-stay properties.
- Hybrid (recommended): Offer RFID card as default; offer BLE mobile key as an opt-in premium for guests who want it. This covers all guest segments without trade-offs.
What Hotels Need to Prepare Before Integration
- PMS API credentials (sandbox and production) — typically available from your PMS account manager
- Confirmed room number mapping (how room numbers in PMS correspond to lock addresses in the lock management system)
- IT contact who can receive webhook events and run integration tests (or Trudian handles this remotely)
- Decision on credential type: RFID only, BLE only, or hybrid
- Network access at the front desk for the encoder terminal (Ethernet or Wi-Fi)
Frequently Asked Questions: Hotel PMS Smart Lock Integration
The most widely integrated PMS platforms are Opera Cloud (via OHIP API), Mews (via Mews Connector marketplace), Cloudbeds (via Cloudbeds Apps), and Apaleo (via open API). Each uses a different integration architecture: OHIP requires Oracle certification, Mews and Cloudbeds use marketplace connector models, and Apaleo uses a fully open REST API. Verify that your lock vendor has a certified or tested integration with your specific PMS version before purchasing.
When a guest checks in via the PMS, the integration triggers an API call to the lock management system, which generates a time-limited credential — either a BLE mobile key sent to the guest's smartphone or an RFID card encoded at the front desk. The credential is automatically valid from check-in time to check-out time. On checkout (or early checkout), the PMS triggers credential revocation. No manual key programming is required at the front desk.
BLE mobile keys are delivered to the guest's smartphone app and enable keyless check-in without front desk interaction. They require the guest to have a smartphone and the hotel's app installed. RFID cards (Mifare Classic, Mifare DESFire, or LEGIC) are physical cards encoded at check-in and work without a smartphone. Most modern hotel lock systems support both simultaneously — mobile key for tech-savvy guests, RFID card as fallback. RFID cards have higher operational cost (card stock, encoding hardware, lost card replacement) but lower guest friction.
Minimum requirements: stable Wi-Fi or wired network coverage on all guest floors (for lock firmware updates and audit log sync — locks do not require continuous connectivity for normal operation), a cloud-hosted or on-premise lock management server with API access, and a PMS version that supports the integration API. For BLE mobile key, guests need iOS 12+ or Android 8+. For RFID, a front desk card encoder and card stock compatible with the lock's reader technology (verify Mifare variant: Classic, Plus, or DESFire EV2).
Well-designed hotel locks operate offline by default — credentials are stored on the lock itself, not fetched from the cloud at door-open time. Internet connectivity is required only for: issuing new credentials, revoking credentials before their scheduled expiry, syncing audit logs, and firmware updates. If the internet goes down after check-in, existing guest credentials continue to work normally. Emergency mechanical override (staff key or master RFID card) must always be available as a fallback.
Yes. Oracle Hospitality Integration Platform (OHIP) requires lock vendors to complete Oracle's certification process before their integration can be listed as officially supported. Uncertified integrations may work technically but are not supported by Oracle and may break with PMS version updates. Ask lock vendors for their OHIP certification status and the specific Opera Cloud version the integration was certified against. Certified integrations are listed in the Oracle Cloud Marketplace.
Yes, if the lock system supports role-based access control (RBAC) and Wiegand or OSDP output for integration with access control panels. Guest room locks and staff access locks can share the same management platform, with different credential types and time schedules. Staff credentials (housekeeping, maintenance, management) are managed separately from guest credentials and are not issued through the PMS. For high-security staff areas, OSDP v2 reader-to-controller communication provides encrypted, tamper-detected access control.
Replacing Your Hotel's Door Lock System?
The HL-500 integrates with Opera OHIP, Mews, Cloudbeds, and Apaleo. AES-128 Mifare DESFire EV2. BLE mobile key. CE certified. Request a hotel project quotation with PMS integration included.