← ALL_LOGS

JWT auth tied to reservation IDs a pattern worth stealing

DATE: 01/01/2025// 2 MIN READ// SYSTEMS_DOMAIN: ENGINEERING

Most hotel guests do not want to create an account to check in. They have a booking reference. That should be enough.

Reservation-scoped JWT auth treats the booking reference plus a verification factor (email, last name, or OTP) as the authentication credential. The resulting token is scoped to a single reservation and expires at check-out. No account required, no password to forget, no friction at the point of arrival.

The security model

The token grants access only to operations that make sense for that reservation check-in, room service, concierge requests, folio review. It cannot be used to access other reservations or account-level data, because there is no account.

The verification factor prevents a guest from accessing another guest’s reservation by guessing a booking reference. A booking reference is not a secret it’s often printed on paperwork but it’s also not sufficient on its own. Pairing it with the guest’s email or last name raises the bar meaningfully without adding friction.

Token expiry

The token should expire at check-out, not at some arbitrary time window. A guest who checks in on Monday and checks out on Friday should have a valid session for the duration of their stay. Expiring their session on Wednesday because “tokens should expire after 48 hours” is a bad experience that adds no security benefit.

The implementation

// Issue token on successful authentication
const token = jwt.sign(
  {
    reservationId: reservation.id,
    guestEmail: guest.email,
    propertyId: property.id,
    scope: ['checkin', 'room-service', 'concierge'],
  },
  process.env.JWT_SECRET,
  { expiresIn: getSecondsUntilCheckout(reservation.checkoutDate) }
)

The scope array gives you fine-grained control over what the token can access. A token issued during pre-arrival might have ['checkin']. After check-in, you reissue with the full scope.

Why this pattern is worth adopting

It dramatically reduces abandonment at the point of first use. Account creation flows lose 40-60% of users in consumer apps. In a hotel context, where the guest is standing at the entrance with luggage, that friction is unacceptable. Reservation-scoped auth threads the needle: secure enough, simple enough, fast enough.