Step-up Authentication in Guest Experience (GX)

Overview

Cloudbeds has introduced step-up authentication for sensitive actions within Guest Experience (GX) to provide an additional layer of account security.

This security enhancement helps protect properties against unauthorized access and account takeover attempts by requiring users to verify their identity again before completing certain high-impact actions.

After a successful verification, the user remains trusted for 8 hours, minimizing disruptions during normal operations while still improving security protection.

Why Cloudbeds Introduced This Feature

Hospitality systems continue to face increasingly sophisticated account takeover attempts targeting:

• Guest communications
• Marketing campaigns
• Email domain settings
• Automation workflows
• Messaging systems

Step-up Authentication helps reduce the impact of:

• Compromised sessions
• Shared or unattended workstations
• Stolen credentials
• Unauthorized access attempts

Even if someone gains access to an active session, they cannot perform protected actions without successfully completing a fresh verification challenge.

How Step-up Authentication Works

When a user accesses Guest Experience (GX) through Cloudbeds PMS and attempts a protected action:

1. Cloudbeds checks whether the user has completed a recent step-up verification
2. If no valid verification exists within the last 8 hours:
   • The user is prompted to verify their identity as follows:

3. Once verification succeeds:
   • The user becomes trusted for the next 8 hours
4. During the trust window:
   Additional protected actions will not trigger another prompt

After the 8-hour window expires, the next protected action will require re-verification.

Supported Verification Methods

Depending on the property's authentication setup, users may verify using:

• Authenticator app (TOTP)
• Push notification
• WebAuthn / Security Key
• SMS code
• Voice verification
  Email verification

Actions Protected by Step-up Authentication

The following actions currently require step-up verification:

• Messaging Approved Links
• Add approved links
• Remove approved links
• Campaigns
• Send campaigns
• Guest Portal
• Edit Guest Portal settings
• Phone Numbers
• Purchase phone numbers
• Guest Chat
• Upload media/files
• Custom Email Domains
• Add domains
• Verify domains
• Edit sender name
• Edit reply-to address
• Automations and Auto-messages
• Create automations
• Edit automations
• Create auto-messages
• Edit auto-messages
• Boosting Credits
• Purchase or manage boosting credits

Frequently Asked Questions

Troubleshooting