The link in the check-in email opens to a stay page with their reservation, the pool, and a single thermostat. Tapping it asks for payment, then they pick a temperature.
Stay links carry an opaque one-time launch code, never entitlement fields. Every mutation re-checks paid status, allowed window, and max temperature. URL tampering can't crank the heater past your cap.