Lockbox self check-in with automatic access codes for US hosts
A lockbox with a combination is the simplest way to welcome guests when you cannot be there: they arrive at 11 p.m., punch in four digits and grab the keys. The weak point is not the box but the code: who receives it, when, and after you have checked what. This guide covers the local rules that matter in the United States and a practical method for sending codes safely without doing it by hand.
- There is no federal guest registration rule, but city permits and HOAs often set conditions on how guests get in.
- Verified self check-in holds up best: details before arrival, a check by you, then the code.
- Send the code on arrival day, not in the booking confirmation.
- Change codes regularly and know who already has the old one.
What US rules say about self check-in
Unlike much of Europe, the United States has no national law requiring lodging operators to record every guest's ID. Rules come from states, counties and cities. Some cities have long required hotels and motels to keep a guest register; in City of Los Angeles v. Patel (2015) the Supreme Court struck down warrantless police inspection of those registers, but not the registers themselves. For short-term rentals, the conditions usually sit in the local permit: a registration number on the listing, a local contact who can respond within a set time, occupancy limits and, in some cities, a requirement that the host lives on site. Our guide to short-term rental permits covers the main patterns.
Even where nothing is required, checking who is coming protects you. Platforms verify some guests, but a direct booking arrives with nothing more than a name and a card. Asking for a photo ID before arrival and comparing it with the booking is a reasonable step, as long as you store it securely and delete it when you no longer need it.
Where the lockbox can go
In a condo or a building with an HOA, a lockbox on a railing or by the entrance may break the association's rules, and some associations restrict short-term rentals altogether. In a rented home you need the landlord's consent. Historic districts can limit what you attach to a facade. Check your insurance as well: some policies have conditions about lockboxes and about break-ins that use one.
The method: check first, hand over second
- Online check-in a few days before arrival: the guest enters their details and, if you ask, uploads a photo ID.
- Your check: you compare details and ID with the booking and call if something looks off.
- Approval: only now is the guest cleared to receive the code.
- Send on arrival day: the code arrives on the morning of check-in, not weeks earlier.
- Rotate codes regularly and let anyone who already has the old code, and has not checked out, know.
Done by hand, this breaks easily: one message sent too early, to the wrong guest or with the old code is enough. That is the part worth automating. For the rest of the messages around the stay, see our guest message templates.
How Vezpa does it
Since October 15, 2026, Vezpa manages access devices: the lockboxes and keypad locks of your rooms and units.
1. Add your devices
In Configuration, under Rooms, open "Access devices". For each device you enter a name (for example "Box 6"), a description, the code and the units it serves. One lockbox can serve several units, and one unit can have several devices, such as the lockbox and the building door. Codes are stored encrypted. Devices are currently the "Offline (fixed code)" type: you set the code yourself, and internet-connected smart locks are not integrated yet.
2. The guest completes online check-in
The check-in link is protected by a PIN sent along with the link. You can make the ID photo optional or required; photos are stored encrypted and deleted seven days after check-out.
3. You approve the check-in
In the booking, the "Keys" card shows where things stand. Once the guest has finished online check-in, the "Approve check-in" button appears. This is not the arrival check-in: you can approve days ahead. Recording the arrival check-in from the booking also counts as approval.
4. The code goes out on its own
The "Access codes" automation sends the message with the access code field:
- only for bookings with an approved check-in; until then the field stays empty, even in other messages;
- on arrival day at the time you choose (8:00 a.m. by default); if you approve later that day, it goes out right away;
- once per booking; with several devices the guest reads, for example, "Box 6: 1123, Front door: 9876";
- in the guest's language; for bookings from a channel that uses a relay email address, the message lands in the channel's chat.
Like the other preset automations, it starts switched off with the text already written: you turn it on once your devices are set up.
5. Change a code without leaving anyone out
The code is not copied into bookings; it is read from the device when the message is sent, so anyone messaged after the change gets the new code. When you save a different code, Vezpa tells you how many guests with a current or upcoming stay already received the old one.
Online check-in and automations are included in every plan, starting with Smart at $39 a month. If you list on several channels, the channel manager guide explains how one calendar keeps them in sync.
Check-in approved, code on its way
Access devices per unit, online check-in with a PIN, approval from the booking and the code sent on arrival day. Open the demo in your browser.
Try it in your browser →Frequently asked questions
- Is lockbox self check-in legal in the US?
- There is no federal rule against lockboxes. Your city or county permit, your HOA rules and your lease or insurance can still set conditions, so check them before installing one. Some cities also require a local contact who can reach the property quickly.
- When should I send the lockbox code?
- On the day of arrival, and only after you have checked the guest's details. Sending it with the booking confirmation hands it out weeks early to someone you have not checked yet, sometimes before you change the code.
- What happens if I change the code in Vezpa?
- Every later message uses the new code, because it is read from the device when the message is sent. When you save, Vezpa shows how many guests with a current or upcoming stay already received the old code.
- Does Vezpa work with smart locks?
- Not today. Access devices are the offline type, with a fixed code you enter yourself, like mechanical lockboxes and keypad locks. Other device types are planned, but connected smart locks are not integrated yet.
Sources and caveats. City of Los Angeles v. Patel, 576 U.S. 409 (2015); local short-term rental ordinances, for example New York City's Local Law 18 as summarized by News12. This is not legal advice; check your city or county code. Vezpa features as of October 2026.