Visitor WiFi settings, field by field

Set up and configure every setting in a Visitor WiFi entry, including Basic scope and credential rules, RADIUS parameters, Ruckus Cloudpath OAuth 2.0 configuration, and WiFi login page branding.

Updated 4 Nov 2026

Open Visitor WiFi

Each row on the Visitor WiFi page configures one guest Wi-Fi network. Opening an entry shows up to three pages in the left rail: Basic on every entry, followed by either RADIUS settings (for Cisco, Unifi, TP-Link, Ruckus, and Generic brands) or OAuth Config and WiFi login page (for Ruckus Cloudpath).

Basic

Setting	What it does	When to change it
Name	Identifies the network entry in the admin list (never shown to visitors).	Name it after the network or office site so administrators can tell multiple entries apart.
Building	Restricts the network to selected buildings (empty matches all buildings).	Set when different buildings operate separate guest Wi-Fi networks; badges print the network matching the visit’s building.
Visiting purpose	Restricts the network to selected visiting purposes (empty matches all purposes).	Set when only specific visitor categories receive guest Wi-Fi access.
Brand	Selects the Wi-Fi controller vendor at creation and determines the sign-in protocol (RADIUS for all brands except Ruckus Cloudpath). Cannot be changed after saving.	Chosen once when adding the entry; create a new entry to switch controller brands.
Username type	Chooses which visitor field serves as the Wi-Fi username: Visitor email address, Registration code, Mobile number, Last name, or Reference code.	Pick an identifier every visitor reliably provides. If multiple visitors share a Last name, Offision distinguishes them by password.
Password type	Chooses what authenticates the visitor: Badge WiFi password, Registration code, Mobile number, or Not required.	Keep Badge WiFi password (the per-visit code generated at check-in) as the secure default; Not required admits anyone entering a matching username.
WiFi SSID	Ruckus Cloudpath only. Network name printed on visitor badges and displayed on lobby boards.	Match the exact SSID broadcast by your Wi-Fi controller (Offision displays the name without configuring the access points).
WiFi password	Ruckus Cloudpath only. Pre-shared network password when the SSID itself is WPA-protected.	Set only if devices must enter a Wi-Fi password before the captive login portal opens.

WiFi SSID and WiFi password do not appear on RADIUS entries because WPA-Enterprise networks have no shared password and broadcast their SSID from your controller.

The Basic page showing building and purpose scope and visitor username and password types.

RADIUS settings

Offision generates the RADIUS connection values on this page for you to copy into your Wi-Fi controller; only UniFi’s MAC addresses list is typed manually.

Setting	What it does	When to change it
Host IP or FQDN	Hostname and IP address of Offision’s RADIUS server.	Read-only; copy whichever format your controller accepts.
Auth port	UDP authentication port (`1812`).	Read-only; copy into your controller.
Secret	Shared secret between your Wi-Fi controller and Offision’s RADIUS server (masked, with show, copy, and Regenerate actions).	Regenerate if compromised, then update your Wi-Fi controller immediately so logins continue working.
NAS identifier	Generated identifier linking incoming RADIUS requests to this Visitor WiFi entry (Regenerate issues a new value).	Keep unchanged during normal operation and copy verbatim into your access points or controller.
MAC addresses	Unifi only (replaces NAS identifier). Comma- or line-separated MAC addresses of your UniFi access points.	List every access point broadcasting the guest SSID; requests from unlisted access points are rejected.

Selecting the Cisco brand formats these same RADIUS values as a step-by-step Meraki setup guide.

The RADIUS settings page with tenant credentials masked.

OAuth Config

Ruckus Cloudpath only. Provides read-only OAuth 2.0 values with copy buttons for your controller’s Custom OAuth 2.0 setup: Name (suggested), Consumer key (Client ID), Consumer secret (Client Secret), Access token endpoint URL, Authorize URL, Data URL, and Scope.

Setting	What it does	When to change it
Consumer secret (Client Secret)	Authenticates your Cloudpath controller to Offision (full secret shown only on creation or regeneration).	Regenerate if lost or exposed, then paste the new secret into Cloudpath immediately.
OAuth redirect URL	Allowed callback URLs from your controller during captive-portal login (one per line).	Add the exact redirect URL specified in your Ruckus Cloudpath portal configuration; sign-in fails without it.

The OAuth Config page showing parameters and copy buttons for your Wi-Fi controller.

Ruckus Cloudpath only. Customizes the browser sign-in page shown to visitors. Every text field supports per-language translations.

Setting	What it does	When to change it
Logo	Displays a logo at the top of the login page (`256 × 256` recommended).	Upload your company logo so visitors recognize the captive portal.
Page title	Heading displayed on the sign-in card.	Customize if you want to display the building or network name.
Welcome message	Short instruction line below the page title.	Tell visitors where to find their Wi-Fi credentials on their badge.
Footer text	Text line at the bottom of the page.	Add acceptable-use terms or reception contact details.
Background Image	Full-bleed background image behind the sign-in card (`1920 × 1080` recommended).	Optional visual branding.

The WiFi login page editor showing logo, title, and message fields.

What this screen does not control

Printed badge layout: Whether Wi-Fi credentials print on visitor badges depends on Visitor label design. See Print the WiFi code on the badge.
Wi-Fi credential validity window: Credentials work strictly from visitor check-in until check-out and cannot be extended past the visit.
Signage Wi-Fi QR widgets: Signage QR widgets use network credentials entered directly on the widget rather than reading Visitor WiFi entries.