Short Term Rental Access Control

You added the cleaner’s code in 2022. Then her sister filled in for two weekends. Then the HVAC tech needed a one-time code that you forgot to delete. Then the painter wanted access for three days. Then last Tuesday you opened your Schlage app and counted 17 active codes on a property that has exactly one front door and one back door. You do not remember who half of them belong to. That is what happens to short term rental access control when nobody is in charge of pruning it. The lock works, the guests check in fine, and the entry log looks normal — but anyone who has ever had a code probably still does, and you would not know unless you sat down with a coffee and audited every line. This guide is about getting that list down to a clean, named, scheduled set you can actually defend if something goes wrong, without buying anything you do not already have.

Who needs a real access policy

If you have one Airbnb that you and your spouse host together and the cleaner has been the same person for five years, you can probably skim this. If you have more than one property, more than one cleaner, occasional contractors, a co-host, a property manager, or any kind of seasonal turnover in your team, you need a written policy — even an informal one in a Notes app. The threat is not break-ins. It is liability and insurance. If something is stolen during a stay, your insurer is going to ask who had access, when, and how you proved it. “I think it was just the guest” is a bad answer. “Here is the audit log showing the four people with active codes during that booking and the timestamps each one entered” is a great answer. The threat-model framing for all of this lives in our overview of whether smart locks are safe for Airbnb hosts.

The four roles every property has

Strip your access list down to four roles. Everything you do should fit one of these. Mixing them is how you end up with 17 codes you cannot account for.

Owner / co-host. Permanent code or app-based unlock. Two people max. Never given out, ever.
Cleaner / turnover team. One named code per person, scheduled to weekdays only, working hours only. If you have two cleaners, two distinct codes.
Contractor / one-off service. Temporary code with a hard expiry of 24-48 hours. Deleted after the visit, even if you think you might need them back.
Guest. Auto-generated per booking, time-bound to check-in and checkout. Never reused — the per-booking pattern is unpacked in our Airbnb door code best practices guide.

Picking hardware that supports this

Not every smart lock can hold this many distinct, scheduled codes. The Schlage Encode and Encode Plus support 100 codes with per-code schedules, which is way more than you need but the schedule support is the key feature. The Yale Assure 2 with Wi-Fi adapter does the same. The August Wi-Fi Smart Lock works through its own keypad and supports per-user time windows. Bluetooth-only locks — including older Yale and August units — usually do not support remote scheduling, and that is the practical limit on running real short term rental access control. If your lock cannot give the cleaner a code that only works Monday through Friday from 9 AM to 4 PM, you do not have access control. You have a permanent code with a polite request that the cleaner only use it during work hours. That is not the same thing. For a deeper look at lock-level hardening, see our notes on smart lock security for rentals.

Setting it up step by step

Open your lock app and screenshot the current code list. This is your before-photo.
Delete every code you cannot identify by name and role. If you are not sure, delete it — people who actually need access will tell you when their code stops working.
Re-create one code per active person, labeled with name and role: “Maria – Cleaner”, “Tom – Co-host”, “HVAC May 12”.
Set the schedule on each one. Cleaners get weekday daytime windows. Contractors get the specific 24-hour window of their visit. Owner has 24/7. No one else.
Connect your booking platform or channel manager — Hospitable, Hostfully, OwnerRez, Smartbnb — so guest codes generate automatically per reservation. Manual is fine if you only have one place; automation is necessary at three or more.
Put a recurring monthly calendar reminder to audit the list. Five minutes. Delete anything labeled with a past date or a name you no longer work with — cadence detail in how often you should change an Airbnb door code.

What to tell your cleaner and contractors

Be direct with your team. This is the message we send any new cleaner: “Your code is 6-2-9-4. It works Monday through Friday, 8 AM to 6 PM. It will not work outside those hours, even for emergencies. If you need access at a different time, text me and I will adjust it for that day. Please do not share this code with anyone, including helpers — if your sister fills in, I will give her her own code.” That last line matters. The most common cause of access sprawl is not malice; it is a cleaner casually telling a backup helper “just use my code, it is 6-2-9-4.” Once that is in someone else’s phone you have lost control of it. Make it explicit that the answer is always to call you for a new code, not to share an existing one — this is the core of guest access code safety applied to staff.

Privacy considerations and what guests notice

Guests do not care that you have access control. They do care if it feels like you are watching them. Two guidelines. First, do not mention the audit log to guests unless something actually goes wrong. Saying “I can see when you came in” reads as monitoring, even when you are just confirming arrival. Second, the cameras stay outside. A doorbell cam (Ring Battery Doorbell Plus, Nest Doorbell, Eufy E340) at the entry is fine and expected; outdoor cams on the driveway are fine if disclosed. Indoor cameras and microphones are off the table for any HomeScript Labs reader, period. If you want a deeper read on the privacy boundary specifically for connected locks, our piece on Airbnb smart lock privacy covers the platform’s expectations and a few real review failures.

Common mistakes

One “team code” used by every cleaner, every helper, every contractor. You cannot tell who entered when.
Permanent contractor codes “because they might come back.” If they do, give a new one. Takes 30 seconds.
No backup. A single point of failure is not access control; it is a coin flip. See our notes on building a real smart lock backup plan.
Skipping the schedule features because “it is too much work to set up.” Per-code schedules take 20 seconds each and they are the entire point of buying a Wi-Fi lock.
Trusting verbal-only access agreements with cleaners. Put it in writing. Email or text counts.

Host checklist

Every active code labeled with name and role.
Every non-owner code on a schedule, not 24/7.
Guest codes generated automatically and expiring at checkout.
Mechanical backup key in a coded lockbox, code rotated quarterly.
Monthly five-minute audit on the calendar.
Written rule with cleaners about not sharing codes.

FAQ

How many codes should an Airbnb smart lock have at once?

For a single property: typically four to eight active codes during a busy week — owner, co-host, cleaner, occasional contractor, and the current guest. If you are looking at more than ten and you only have one or two cleaners, you have orphan codes that should be deleted. The Schlage Encode supports 100 codes; the limit is your audit discipline, not the hardware.

Should every guest get a different code?

Yes. Always. A unique per-booking code is the entire reason connected locks exist for hosts. It gives you proof of who entered when, it expires automatically, and it removes any ambiguity if something goes missing. Sharing a single “guest code” across bookings looks fine until the day a guest’s code still works after their stay and you cannot prove it should not have.

What if my cleaner needs to swap with someone last minute?

Generate a one-day code for the substitute and text it to your regular cleaner to pass on. The original cleaner’s code stays intact. The substitute’s code expires at midnight. You have a record of which person entered, no shared credentials, and no follow-up cleanup. This takes about a minute in any modern lock app and it is the single highest-leverage habit in this entire guide.

Does Airbnb require a specific access setup?

No specific brand or system is mandated. The platform requires that you disclose how guests will enter, deliver the credentials before arrival, and avoid indoor surveillance. Beyond that, the access architecture is your call. We unpack the platform-side rules in our Airbnb lock requirements guide, and the at-the-door process in our Airbnb self check-in safety tips.

Next steps

Open your lock app right now and screenshot the code list. Then start deleting. The vast majority of hosts free up at least half their slots on the first audit. The whole point of access control is that it should be invisible — to your guests, to your team, and ideally to you, once the schedules and automations are doing the work.