Users, permissions and two-step verification on Booking.com, Airbnb, Expedia and Google Business Profile: who gets into your extranet (2026)

Updated: 10 November 2026

At many properties the extranet password sits on a sticky note and is known by reception, the marketing agency and the nephew who built the website. That works until someone leaves, an email falls for a scam or nobody knows who changed a rate. The platforms let you give each person their own user with limited permissions and ask for a second code at login. This guide sums up what the official help pages of Booking.com, Airbnb and Google say (checked on 10 November 2026) and marks as «not confirmed» what we could not read, such as Expedia's official help.

The short answer

The essentials:

One person, one user: Booking.com, Airbnb and Google let you invite each team or agency member with their own email and different permissions.
Booking.com: logging in to the extranet requires two-step verification (a PIN to the verified phone). Since when: not confirmed.
Airbnb: two-step verification («Strong Customer Authentication») is required for all Hosts in the European Economic Area. Since when: not confirmed.
Google Business Profile: only one primary owner; managers cannot add or remove users.
Expedia Partner Central: we could not read its official help on users or two-step verification; what follows is marked as not confirmed.
When someone leaves, remove their access the same day and change any shared passwords they knew.

Booking.com: account types and permissions

According to Booking.com's partner help:

Primary: only one account, created when the contract is signed; its access cannot be edited and it can grant or remove admin rights.
Admin: sees the whole extranet and manages other accounts. There always needs to be at least one admin.
User: an account for team members, with the permissions set by the admin or primary account.
Chain (created by Booking.com on request for chains) and Connectivity provider (limited, non-admin access for your channel manager).
Permissions you can grant or withhold: Reservations, Rates & Availability, Property details, Performance data, Finance, Promotions, Notification, Programmes, Manage users and Connectivity provider.
How to add someone: User account icon (top right) > «Create and manage users» > «Add a user» (name and email) > «Next step: Set up access rights» > «Send invite». To change permissions, «Manage» next to the user.
Example: reception with Reservations; the marketing agency with Promotions and Performance data, but without Finance or Manage users.
The Group extranet has no admin level: the user must be added to each property.

Booking.com: two-step verification

According to Booking.com's help on contact details:

«Logging in to the extranet requires two-factor authentication»: you need a PIN as well as the password.
The PIN goes to the number verified on the Security page; if there is none, to the number given when the account was set up.
Adding a verified number is approved by email: you need access to the registered email.
Only users with admin rights can change an account's contact details; with several properties, update each property ID.
Since when it is mandatory and whether authenticator apps are supported: not confirmed.

Airbnb: co-hosts and permissions

According to Airbnb's Help Centre (articles 1534 and 1632):

Three levels: full access (listing, pricing, reservations, Resolution Centre, earnings and other co-hosts' permissions), calendar and messaging access (messages guests and views the calendar without editing it) and calendar access (views it without editing).
Co-hosts added before 3 May 2023 have full access by default: worth reviewing.
A full-access co-host can add, remove or change other co-hosts' permissions, but cannot add more full-access co-hosts.
Only the listing owner sets up or edits co-host payouts; co-hosts cannot see your payout method or taxpayer info.
Airbnb is clear: you are responsible for your co-hosts, including those added by a full-access co-host.
Maximum number of co-hosts (10 is quoted): not confirmed in the full text.

Airbnb: two-step verification

According to Airbnb article 2842:

Airbnb calls it «Strong Customer Authentication» (SCA) and links it to European payment services regulation, to help prevent fraud.
It is required for all Hosts in the European Economic Area (Spain, Italy, Portugal and Greece included).
It uses a one-time code by SMS or call, a PIN and security questions; on some devices, fingerprint or face recognition.
Turn it on in Account > Login & security; you need an up-to-date phone number on the account.

Expedia Partner Central

Here we could not read Expedia's official help (the support page did not open):

A guide by a software vendor (unofficial source) recommends one user per person and permissions by role: whoever answers messages does not need to change rates.
The same source says a verification code is sent at login to the account's email or phone, and that if you have lost access to both you must contact Expedia support.
Exact role names, the menu to add users and whether two-step verification is mandatory: not confirmed. Check the help inside Partner Central.

Google Business Profile: primary owner, owner and manager

According to Google Business Profile Help:

Primary owner: there is only one. They cannot remove themselves without first transferring primary ownership.
Owner: full control, including adding or removing users and deleting the profile.
Manager (formerly «site manager»): almost the same (info, reviews, posts, photos, messages), but cannot add or remove users or delete the profile. The right role for an agency.
Add: More > Business Profile settings > People and access > Add, email and role > Invite. Each person needs their own Google Account.
For 7 days, a new owner or manager cannot delete the profile, remove others or transfer primary ownership.
Transfer ownership: only the primary owner, in People and access > user > Access > Edit > Primary owner > Save. The recipient must already be an owner or manager.
Which role the former primary owner keeps and whether Google requires two-step verification to manage the profile: not confirmed.

When an employee or agency leaves

A checklist for the day they leave:

Booking.com: in «Create and manage users», remove their permissions or account. If they were an admin, check another admin remains and that the verified PIN phone is not theirs.
Airbnb: Listings > listing > Listing editor > Co-hosts > Remove co-host. They lose access to the listing, calendar and messages; you remain responsible for bookings, including those they accepted.
Google: People and access > person > «Remove person». If the agency was primary owner, ask them to transfer ownership before removing them (and allow for the 7 days).
Expedia: remove their user in Partner Central (exact steps not confirmed).
Change the password of the reservations email and any password they knew, and review the channel manager.
Make sure the primary owner or admin is always someone in-house, not the agency.

Don't share passwords

Why one user per person is safer:

With individual users, removing someone does not force everyone to change their password.
Each person sees only what they need: whoever answers messages does not touch rates or invoices.
Two-step verification goes to each person's phone; with a shared password, the code ends up on a phone you don't control.
If one person falls for a fake email, the damage is limited to their permissions.
To spot fake messages that try to steal access, read our phishing guide (link below).

How iQuota helps

iQuota connects your property to AI assistants for direct booking, with no commission and payment at the property:

Your details reach AI from your profile, not from a shared password.
We do not promise bookings or that a given AI will show you: it depends on each assistant.

Frequently asked questions

Is two-step verification mandatory on Booking.com?

Yes: according to Booking.com's help, logging in to the extranet requires a PIN sent to the verified phone. Since what date: not confirmed.

And on Airbnb?

It is required for all Hosts in the European Economic Area, according to Airbnb article 2842.

Which role should my agency have on Google Business Profile?

Manager: it can edit the profile and reply to reviews, but cannot add or remove users or delete the profile.

Can my receptionist message guests on Airbnb without touching prices?

Yes: «calendar and messaging access» lets them message guests and view the calendar without editing it.

How many admins should I have on Booking.com?

Booking.com requires at least one; it is sensible to have an in-house admin as well as the primary account.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά