What the UniFi hotspot does,
and where it stops
UniFi is excellent network equipment. It is not a CRM, and it was never trying to be one.
UniFi handles this on its own
UniFi does not do this
How VoqadoWiFi sits on your UniFi network
Both UniFi generations, detected automatically
UniFi OS consoles such as the Dream Machine and UDM Pro authenticate one way, and the legacy self-hosted Network Server on port 8443 authenticates another. VoqadoWiFi probes the controller and picks the right path itself, so you do not need to know which generation you are on before you start.
Works behind a reverse proxy or Cloudflare Tunnel
Exposing a UniFi console through a proxy or tunnel commonly strips the response header that carries the CSRF token, which is what breaks most third-party integrations in that setup. VoqadoWiFi falls back to reading the token from the TOKEN cookie, so a proxied console still authorises guests.
Self-signed certificates are tolerated
UniFi consoles ship with a self-signed certificate and most operators never replace it. The integration accepts that rather than demanding you put a public certificate on the console before guest login will work.
Every guest login becomes a contact
The redirect carries the client MAC, the access point MAC, the site, and the URL the guest was trying to reach. Your form supplies the identity. Together they become a guest record that recognises the same person on their next visit.
Review requests timed off real sessions
Because the platform records when the session began and how long it ran, the review request can wait for the visit to end instead of arriving while the guest is still sitting in your venue.
Test Connection with click-to-fill site ids
UniFi generates internal site ids that look like random strings, which makes them easy to get wrong. Test Connection lists the sites your account can see with their display names, and you click the right one to fill the field.
UniFi OS console or legacy controller
The two generations authenticate differently, which is why so many third-party portals only support one. VoqadoWiFi detects which you have and uses the right path.
UniFi OS consoles
Dream Machine, UDM Pro, and other UniFi OS hardware
Legacy UniFi Network Server
Self-hosted software controller on your own server or VPS
The reverse proxy and tunnel case
Plenty of operators expose a UniFi console through a reverse proxy or a Cloudflare Tunnel rather than opening a port. That setup often strips the response header carrying the CSRF token, and without it the console rejects the authorisation call, which is why third-party portals so often fail specifically in tunnelled deployments. VoqadoWiFi reads the token from the TOKEN cookie JWT when the header is gone, so the guest still gets online.
Connecting your UniFi console
Four steps. None of them require replacing hardware or reconfiguring your production networks.
Create the location and set the vendor to UniFi
Add the venue in VoqadoWiFi and mark it as a UniFi site. This selects the UniFi redirect handling and the authorisation path used when a guest submits your form.
Point the UniFi guest portal at VoqadoWiFi
In the UniFi Network application, open the guest hotspot settings and enable an external portal server pointed at your VoqadoWiFi URL. UniFi sends guests to a path of the form /guest/s/<site>, where <site> is the internal site name. Add the VoqadoWiFi domain to the pre-authorisation allowed list so an unauthorised device can load the page.
Enter controller URL, site, and credentials, then test
In the VoqadoWiFi dashboard, add the console URL, the site, and the account VoqadoWiFi should authenticate with. Use a dedicated account rather than your personal admin login. Press Test Connection: it reports whether the console is UniFi OS or legacy, lists the sites the account can see, and lets you click one to fill the site id.
Walk the flow on a device that has never joined
Join the guest network from a phone with no history on it. You should see your branded portal, get online after submitting, and find the new guest in the dashboard immediately. A device UniFi has already authorised will bypass the portal entirely, which makes it useless as a test.
Where UniFi portals actually break
Work down this list before escalating. The first two account for most tickets.
The portal never loads on the guest device
VoqadoWiFi is not in the pre-authorisation allowed list.
UniFi blocks everything an unauthorised device tries to reach except the destinations you explicitly permit. Until the VoqadoWiFi domain is on that list, the redirect sends the guest somewhere they are not allowed to go, and they get a blank page or a timeout. Add the domain and retest on a fresh device.
Guests submit the form and stay offline
The authorisation call to the console is failing.
The portal worked; the callback did not. Run Test Connection. If the console is unreachable, VoqadoWiFi cannot reach it from outside the venue, or the URL, port, or protocol is wrong. Remember that legacy self-hosted controllers usually sit on 8443 while UniFi OS consoles sit on 443, and putting the wrong port in the field produces exactly this symptom.
Authorisation fails only when the console is behind a proxy or tunnel
The CSRF token header is being stripped in transit.
This is the classic Cloudflare Tunnel and reverse-proxy failure, and it breaks a lot of UniFi integrations. VoqadoWiFi handles it by reading the token out of the TOKEN cookie JWT when the header is missing. If it still fails, check that your proxy forwards cookies and does not rewrite the request path, since the UniFi OS API prefix must survive the hop.
The site id is rejected or the wrong venue is authorised
The site field holds a display name rather than the internal site name.
UniFi shows you a friendly name in the interface but uses an internal id in URLs, and for sites created after the first one that id is an auto-generated string rather than "default". Run Test Connection and click the site from the list it returns instead of typing what you see in the UniFi interface.
Login works, but the guest is dropped again shortly after
The guest policy expiry is shorter than expected.
UniFi authorises a device for a set duration, then puts it back behind the portal. If guests report being kicked back to the login page, the guest policy expiry in your UniFi settings is the place to look, not the VoqadoWiFi portal.
What gets captured at a UniFi login
Part of it comes from the form you designed. The rest arrives on the redirect from the console.
What it costs to connect UniFi
The integration is part of the product, not an upsell. Prove it on the free plan first.
25 logins per month, 1 location. Enough to connect a console and watch a real guest complete the flow.
For venues running the guest portal as a live marketing channel rather than a trial.
Quoted for larger estates. Worth a conversation if you run several sites on one console.
UniFi captive portal questions
Including the ones you only hit after the first guest complains.