Skip to content
See the demoStart free
Networking

What is External Captive Portal?

Definition

An external captive portal is a login page hosted outside the network equipment, on a separate web platform. The controller redirects unauthenticated guests to it, and the portal calls back to authorise the session once the guest logs in. It allows far richer design, data handling and integrations than a portal built into firmware.

The authorisation handshake

The flow has four steps. First, the controller intercepts an unauthenticated device and redirects it to the portal URL, appending parameters that identify the client, the access point and the site. Second, the guest completes the login and consent on the portal. Third, the portal calls the controller's authorisation endpoint with those parameters and a shared secret, requesting that the session be granted, often with a duration or bandwidth limit. Fourth, the controller moves the client to the authorised policy and the portal redirects the guest onward. Every step needs the portal domain in the walled garden, or the guest never sees step two.

What it makes possible

Because the page is a real web application, it can do things firmware cannot: multi-step forms, per-location branding, live validation, consent records stored in a database you can query and export, and hand-offs to other systems such as an email platform or a webhook. It also means one portal can serve many sites and vendors while presenting a single guest database, which is the foundation of multi-location WiFi marketing.

What to get right

Three things cause most of the pain. The walled garden must include the portal domain and every third-party hostname the page loads. The shared secret between portal and controller must be strong and stored securely, since anyone who has it can authorise sessions. And the portal must fail gracefully: if the authorisation call errors, tell the guest something honest and retry rather than leaving them on a spinner. Test the whole flow from a real phone on the real network, not from a laptop already on the wired side.

Run a guest WiFi login on your own network

VoqadoWiFi runs branded guest portals on TP-Link Omada and Ubiquiti UniFi networks. The Starter plan is free forever: one location, 500 logins a month, consent logging included.

Common questions about external captive portal

Is an external portal less reliable than a built-in one?

It adds an internet dependency, so a correct walled garden and sensible error handling matter. In exchange you get design control, real data storage and integrations that firmware portals cannot provide.

Can one external portal serve multiple venues?

Yes. That is one of its main advantages. A single portal platform can serve many sites, each with its own branding and consent copy, while consolidating guest data into one account.

Related terms

External Captive Portal rarely comes up on its own. These are the entries operators usually read next.