Secure iCal URLs and rotate tokens

iCal links control inventory visibility and must be treated as secrets. Export tokens are generated from 32 random bytes, stored only as a one-way hash and shown once. Imported feed URLs use authenticated encryption at rest with a dedicated iCal cipher; the admin screen displays an origin-style masked value.

Safe operating rules

• Use public HTTPS feeds only. The importer rejects credentials, fragments, private hosts, IP literals and unsafe redirects.
• Store an export URL in an approved password manager and restrict who can paste it into an OTA. Do not put it in screenshots, browser analytics or support logs.
• Keep wp-config.php security keys backed up securely. Replacing keys makes encrypted imported URLs unreadable; re-enter the source URL rather than attempting database recovery.
• Do not enable shared page caching for a tokenized .ics route. The response is checked before 304 handling and unknown or rotated tokens return 404.

Rotate after exposure

1. Open Hotel Booking → Rooms → OTA Sync for the affected room type.
2. Select Create replacement link and confirm the warning.
3. Copy the new one-time URL and update every OTA connection.
4. Test the new feed from a private request, then verify the old URL returns 404.

Token rotation does not delete bookings or external blocks. On license loss, new fetches and exports stop, while existing blocks remain enforced and read-only. If a secret appears in a log, rotate it, redact the evidence and record the time and affected room without attaching the original value.