API and webhooksConnect Alojando to your own system

Getting started

1. In the dashboard, go to Settings → API & webhooks and create a key. It is shown only once: store it somewhere safe.
2. Send it with every request in the Authorization header as a Bearer token.
3. Try the request below: it returns your properties.

curl https://alojando.app/api/v1/alojamientos \
  -H "Authorization: Bearer alj_live_…"

What you can read

What a booking looks like

{
  "id": "ical_cmv0bqsl0004hhbeengd9zff4",
  "alojamiento": { "id": "cmf2…", "nombre": "Depto Palermo 3B" },
  "canal": "airbnb",
  "canal_nombre": "Airbnb",
  "estado": "confirmada",
  "check_in": "2026-11-20",
  "check_out": "2026-11-24",
  "noches": 4,
  "huespedes": 2,
  "huesped": { "nombre": "Ana Pérez", "email": null, "telefono": "+54 9 11 5555-0000" },
  "codigo_confirmacion": "HMXXXXXXXX",
  "importe": {
    "moneda": "USD", "total": 412, "alojamiento": 372, "limpieza": 40,
    "huesped_adicional": null, "ajuste": null, "comision_portal_pct": 15.5
  },
  "pago": { "estado": null },
  "creada_en": "2026-10-14T13:02:11.000Z",
  "cancelada_en": null
}

check_out is the departure day (that night is not counted). Data we don’t have is null: an external iCal calendar, for example, carries no amounts or guest details, and we never fill them with estimates.

Webhooks

In the same dashboard page you add your server’s URL and pick the events. Changes are checked every 5 minutes and each event arrives as a POST with a JSON body:

{
  "id": "evt_5f0c…",
  "evento": "reserva.creada",
  "creado_en": "2026-10-14T13:05:00.000Z",
  "datos": { "reserva": { … } }
}

Verify the signature. Every event carries an X-Alojando-Firma header shaped t=<unix>,v1=<hex>: an HMAC-SHA256 of "<t>.<body>" with the webhook secret (it starts with whsec_). Compute it over the raw body, before parsing it, and reject events whose t is more than 5 minutes old.

import { createHmac, timingSafeEqual } from 'crypto'

// cuerpo: el cuerpo crudo (string), tal como llegó
function firmaValida(cuerpo, encabezado, secreto) {
  const partes = Object.fromEntries(encabezado.split(',').map((p) => p.split('=')))
  const t = Number(partes.t)
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false
  const esperada = createHmac('sha256', secreto).update(`${t}.${cuerpo}`).digest('hex')
  const a = Buffer.from(esperada)
  const b = Buffer.from(partes.v1 || '')
  return a.length === b.length && timingSafeEqual(a, b)
}

Retries. Reply with a 2xx code within 10 seconds. Otherwise we retry after 1, 5 and 30 minutes, then 2, 6, 12 and 24 hours. The X-Alojando-Envio header is the same on every retry: use it to avoid processing the same event twice. A webhook that fails 50 times in a row is paused and can be reactivated from the dashboard. "Send test" checks the connection right away.

Limits and rules

• Read only: the API doesn’t create or change bookings.
• Up to 120 requests per minute per key. Above that you get a 429 with a Retry-After header.
• Dates are YYYY-MM-DD and timestamps ISO 8601 (UTC).
• Errors always have the same shape: { "error": { "codigo", "mensaje" } }.
• Each key reads ONE business’s data, including guest names, emails and phone numbers. Treat it like a password; if it leaks, revoke it from the dashboard.