Salto KS integration: introduction and functional background
What is Salto KS?
Salto KS (Keys-as-a-Service) is the cloud-based access-control system by Salto Systems. Physical locks are managed via the cloud and driven through an IQ online gateway — a device that connects the on-site locks to the Salto KS platform. i-Reserve connects to the Salto KS API to grant a booking remote access to the right lock.
How the integration works
- An i-Reserve object (product) is linked in the mapping to a specific lock in the Salto installation.
- Once a booking has reached the configured status, the lock may be opened. On the open action, i-Reserve sends an open command to the mapped lock.
- The IQ online gateway receives the command and opens the physical lock.
- Optionally i-Reserve records the open timestamp in a booking field and/or automatically moves the booking to a check-in status.
The integration therefore works via an open action per lock, not via the old “create / revoke visit” model. The booking status only determines from when opening is allowed.
The IQ setup and the PIN (important)
The open command is not sent with a fixed key but with a time-based OTP (one-time password). That OTP is computed from three things: the IQ secret, the active IQ PIN and the current time. That is why the IQ gateway must first be activated with a PIN before the integration can open locks.
- IQ secret — a secret key belonging to the IQ gateway (fetched once from the platform).
- IQ PIN — a 4-digit code active on the IQ gateway. i-Reserve fetches the current PIN (GET PIN) and optionally sets a new one (Set PIN). After a successful activation i-Reserve shows “IQ is activated”.
- OTP — on every open command i-Reserve computes a new, short-lived code from secret + PIN + time. Without an activated IQ PIN, i-Reserve cannot sign a valid command and the door will not open.
Because the PIN is part of the OTP: if you change the IQ PIN outside i-Reserve, you must re-activate the integration (run GET PIN / Set PIN again).
Authentication
The integration uses OAuth 2.0 (password grant): you enter the Salto KS account (username + password). The underlying client credentials of the integration are managed at platform level by i-Reserve. You choose an environment (acceptance or production); each environment has its own platform URLs. The access token is refreshed automatically.
Site and mapping
An installation is called a Site in Salto. You enter the human-readable Site UID (e.g. NL6254340082); i-Reserve resolves it to the internal Site id. In the mapping you link each i-Reserve object (product) to a lock from the dropdown (fetched from the Site). An object without its own mapping can fall back to a default lock.
Times and time zones
The window in which opening is allowed relates to the booking times and the time before setting (minutes that opening is already allowed before the start time). The integration uses UTC; make sure the server has the correct time zone as default.
Limitations / things to watch
- The IQ gateway must be online; without a connection the command does not reach the lock.
- The integration must be set up with an activated IQ PIN (otherwise no valid OTP).
- Acceptance and production are separate environments with their own account, site and IQ; test in acceptance first.
- The booking status does not open the lock by itself — it only sets from when the open action is allowed.
