Skip to main content

Account and security

Protect your account​

  • Use a unique password and do not share it with staff or guests.
  • Keep the email address on the account current.
  • Sign out on shared devices.
  • Review connected modules and devices regularly.

API keys​

Create API keys from your profile only when an integration needs them. Give each integration its own key, store it in a secret manager, and never commit it to source code or paste it into public tickets. Revoke a key immediately when it is exposed or no longer needed.

The API key belongs in the X-API-Key header. Do not put it into a URL, browser code, or a playroom description.

Device and module credentials​

CardDAV credentials and access permissions are separate from API keys. Name them by device or purpose, save secrets when they are first shown, and revoke them individually when a device is lost, replaced, or no longer trusted.

Suspicious activity​

If you see an unexpected booking, payment, device, or integration:

  1. Secure the account and stop sharing affected credentials.
  2. Revoke the affected API key or device credential.
  3. Review recent bookings and payment activity.
  4. Contact My Playrooms support with the booking or account reference.