New: AI-powered Google Review automation is liveLearn more →
VoqadoWiFi
Ubiquiti UniFi

UniFi captive portal with guest email capture

Your UniFi console authorises guests and then forgets them. VoqadoWiFi replaces the hotspot page with a branded portal that turns each login into a contact you own. Works with UniFi OS consoles and the legacy self-hosted Network Server, including consoles behind a reverse proxy or Cloudflare Tunnel.

UniFi OS and legacy controllers
Proxy and tunnel friendly
Free forever plan

What the UniFi hotspot does,
and where it stops

UniFi is excellent network equipment. It is not a CRM, and it was never trying to be one.

UniFi handles this on its own

Holds guest devices in a pre-authorisation state on your guest network
Serves a hotspot portal and authorises a device MAC for a set number of minutes
Applies your guest policy: bandwidth limits, VLAN, and session expiry
Supports vouchers, simple passwords, and basic form-based hotspot login

UniFi does not do this

Keep a durable guest identity that outlives the authorisation window
Merge the same person across visits, devices, and sites into one record
Send a review request, a birthday offer, or any campaign after the guest leaves
Give you a consented, exportable contact list you can market to
The layer on top

How VoqadoWiFi sits on your UniFi network

Both UniFi generations, detected automatically

UniFi OS consoles such as the Dream Machine and UDM Pro authenticate one way, and the legacy self-hosted Network Server on port 8443 authenticates another. VoqadoWiFi probes the controller and picks the right path itself, so you do not need to know which generation you are on before you start.

Works behind a reverse proxy or Cloudflare Tunnel

Exposing a UniFi console through a proxy or tunnel commonly strips the response header that carries the CSRF token, which is what breaks most third-party integrations in that setup. VoqadoWiFi falls back to reading the token from the TOKEN cookie, so a proxied console still authorises guests.

Self-signed certificates are tolerated

UniFi consoles ship with a self-signed certificate and most operators never replace it. The integration accepts that rather than demanding you put a public certificate on the console before guest login will work.

Every guest login becomes a contact

The redirect carries the client MAC, the access point MAC, the site, and the URL the guest was trying to reach. Your form supplies the identity. Together they become a guest record that recognises the same person on their next visit.

Review requests timed off real sessions

Because the platform records when the session began and how long it ran, the review request can wait for the visit to end instead of arriving while the guest is still sitting in your venue.

Test Connection with click-to-fill site ids

UniFi generates internal site ids that look like random strings, which makes them easy to get wrong. Test Connection lists the sites your account can see with their display names, and you click the right one to fill the field.

UniFi OS console or legacy controller

The two generations authenticate differently, which is why so many third-party portals only support one. VoqadoWiFi detects which you have and uses the right path.

UniFi OS consoles

Dream Machine, UDM Pro, and other UniFi OS hardware

Login endpoint/api/auth/login
API path prefix/proxy/network
Typical port443
Session tokenCSRF token issued at login

Legacy UniFi Network Server

Self-hosted software controller on your own server or VPS

Login endpoint/api/login
API path prefixnone
Typical port8443
Session tokenCookie-based session

The reverse proxy and tunnel case

Plenty of operators expose a UniFi console through a reverse proxy or a Cloudflare Tunnel rather than opening a port. That setup often strips the response header carrying the CSRF token, and without it the console rejects the authorisation call, which is why third-party portals so often fail specifically in tunnelled deployments. VoqadoWiFi reads the token from the TOKEN cookie JWT when the header is gone, so the guest still gets online.

Connecting your UniFi console

Four steps. None of them require replacing hardware or reconfiguring your production networks.

01
1

Create the location and set the vendor to UniFi

Add the venue in VoqadoWiFi and mark it as a UniFi site. This selects the UniFi redirect handling and the authorisation path used when a guest submits your form.

02
2

Point the UniFi guest portal at VoqadoWiFi

In the UniFi Network application, open the guest hotspot settings and enable an external portal server pointed at your VoqadoWiFi URL. UniFi sends guests to a path of the form /guest/s/<site>, where <site> is the internal site name. Add the VoqadoWiFi domain to the pre-authorisation allowed list so an unauthorised device can load the page.

03
3

Enter controller URL, site, and credentials, then test

In the VoqadoWiFi dashboard, add the console URL, the site, and the account VoqadoWiFi should authenticate with. Use a dedicated account rather than your personal admin login. Press Test Connection: it reports whether the console is UniFi OS or legacy, lists the sites the account can see, and lets you click one to fill the site id.

04
4

Walk the flow on a device that has never joined

Join the guest network from a phone with no history on it. You should see your branded portal, get online after submitting, and find the new guest in the dashboard immediately. A device UniFi has already authorised will bypass the portal entirely, which makes it useless as a test.

Troubleshooting

Where UniFi portals actually break

Work down this list before escalating. The first two account for most tickets.

The portal never loads on the guest device

VoqadoWiFi is not in the pre-authorisation allowed list.

UniFi blocks everything an unauthorised device tries to reach except the destinations you explicitly permit. Until the VoqadoWiFi domain is on that list, the redirect sends the guest somewhere they are not allowed to go, and they get a blank page or a timeout. Add the domain and retest on a fresh device.

Guests submit the form and stay offline

The authorisation call to the console is failing.

The portal worked; the callback did not. Run Test Connection. If the console is unreachable, VoqadoWiFi cannot reach it from outside the venue, or the URL, port, or protocol is wrong. Remember that legacy self-hosted controllers usually sit on 8443 while UniFi OS consoles sit on 443, and putting the wrong port in the field produces exactly this symptom.

Authorisation fails only when the console is behind a proxy or tunnel

The CSRF token header is being stripped in transit.

This is the classic Cloudflare Tunnel and reverse-proxy failure, and it breaks a lot of UniFi integrations. VoqadoWiFi handles it by reading the token out of the TOKEN cookie JWT when the header is missing. If it still fails, check that your proxy forwards cookies and does not rewrite the request path, since the UniFi OS API prefix must survive the hop.

The site id is rejected or the wrong venue is authorised

The site field holds a display name rather than the internal site name.

UniFi shows you a friendly name in the interface but uses an internal id in URLs, and for sites created after the first one that id is an auto-generated string rather than "default". Run Test Connection and click the site from the list it returns instead of typing what you see in the UniFi interface.

Login works, but the guest is dropped again shortly after

The guest policy expiry is shorter than expected.

UniFi authorises a device for a set duration, then puts it back behind the portal. If guests report being kicked back to the login page, the guest policy expiry in your UniFi settings is the place to look, not the VoqadoWiFi portal.

What gets captured at a UniFi login

Part of it comes from the form you designed. The rest arrives on the redirect from the console.

Email address
The core of the guest record and the reason to run an external portal at all.
Name
First and last, used to personalise campaigns and review requests.
Phone (optional)
Only captured if you turn the field on in your portal form.
Marketing consent
Logged at the moment of login so the list holds up to scrutiny later.
Client MAC
Sent by UniFi in the redirect. This is what gets authorised and what identifies a returning device.
Access point MAC and SSID
Tells you which access point and which network the guest joined.
UniFi site
Taken from the /guest/s/<site> path, so multi-site consoles stay cleanly separated.
Login timestamp and session length
Drives timing rules such as holding a review request until the visit has ended.

What it costs to connect UniFi

The integration is part of the product, not an upsell. Prove it on the free plan first.

Starter
Free forever

25 logins per month, 1 location. Enough to connect a console and watch a real guest complete the flow.

Growth
$49/mo

For venues running the guest portal as a live marketing channel rather than a trial.

Enterprise
Custom

Quoted for larger estates. Worth a conversation if you run several sites on one console.

UniFi captive portal questions

Including the ones you only hit after the first guest complains.

Both work. UniFi OS consoles such as the Dream Machine and UDM Pro authenticate at /api/auth/login and address the network API under a /proxy/network prefix, while the legacy self-hosted Network Server uses /api/login with no prefix and usually listens on 8443. VoqadoWiFi detects which one it is talking to and adapts, so you do not have to declare it up front.

Yes. That setup normally breaks UniFi integrations because the proxy strips the response header carrying the CSRF token, and without that token the console rejects the authorisation call. VoqadoWiFi reads the token from the TOKEN cookie JWT instead when the header is missing, so a tunnelled console still authorises guests.

No. UniFi consoles ship with a self-signed certificate and the integration tolerates it. You do not have to put a publicly trusted certificate on the console before guest logins will work.

Create a dedicated local account on the console for the integration rather than handing over your own administrator login. It keeps the access auditable, and rotating it later does not lock you out of your own console.

Do not type it from memory. UniFi generates internal site ids that do not match the display names you see in the interface, and only the first site is called "default". Enter your console URL and credentials in VoqadoWiFi and press Test Connection: it returns the sites the account can see with both the internal id and the display name, and you click the right one to fill the field.

It authenticates, which is a different job. The UniFi hotspot can put a form in front of a guest and let them online, but it does not build a deduplicated customer record, does not recognise the same guest returning next month, and does not send anything afterwards. VoqadoWiFi keeps UniFi doing what it is good at and adds the customer layer on top.

Yes. The network vendor is set per location, so a mixed estate runs under one account with a single shared guest database. The Omada setup is documented on its own page.

It is included, not an add-on. Starter is free forever with one location and 25 logins per month, which is enough to connect a console and prove the flow. Growth is 49 dollars per month, and Enterprise is quoted for larger estates.

UniFi + VoqadoWiFi

Your console already knows
who walked in

It just throws that away when the session ends. Point the hotspot at VoqadoWiFi and keep it instead. Free forever to start.

Free forever plan  ·  25 logins/mo  ·  1 location