Managing guest accounts and vouchers

The day-to-day work of the Account menu: creating and looking after guest accounts, generating and printing vouchers, selling or handing out top-up codes, and changing many accounts at once. This page walks through each job in the order you would do it. Every field is listed in Account, voucher and top-up fields; the limits a guest gets come from their profile, covered in Profiles, bandwidth and quotas.

Users, vouchers and top-up codes

	What it is	How the guest uses it
User (Account › Users)	A named account with a username and password, and optionally a name, email and phone number.	Signs in on the portal with username and password.
Voucher (Account › Vouchers)	A code, usually one of a printed batch. The code is both the username and the password.	Types the code on the portal.
Top-up code (Account › Topup Code)	A one-time code worth extra time and/or data. It is not an account and cannot be used to sign in.	Adds it to an existing user or voucher to extend it.

Many users are never created by hand: sign-up, social, OTP and payment login methods create them automatically the first time a guest signs in. They appear on the same Users list, and the Signed up via column tells you how each one arrived.

Users and vouchers share one set of names, so a voucher code can never be the same as a username.

Before you start: profiles

Every user and voucher must have a profile — the speed, data, time and simultaneous-login limits it gets. The Profile list on every form below shows only the profiles that already exist under Account › Profiles, so create those first. See Profiles, bandwidth and quotas.

If you restrict accounts to particular locations, create your zones first as well; the Allowed Zone lists show only zones that exist.

Creating a user account

1. Go to Account › Users and click Create.
2. Fill in:
   • Username — what the guest types to sign in. No spaces, commas, semicolons, quotes or angle brackets; up to 120 characters; must not already be in use by another user or voucher.
   • Password — at least 6 characters (up to 64). The eye button shows what you typed.
   • Profile — the plan this account gets.
3. Open Advanced Configuration if you need any of these:
   • Full Name, Email, Phone (include the country code, for example 60123456789).
   • Status — Active (the default), Expired or Suspended.
   • Expiry Date — the account cannot sign in after this date and time. Leave it empty for no expiry.
   • Authentication Type — Internal (the password you typed, the usual choice), or PMS, Active Directory or LDAP when the password is checked by that system instead.
   • Allowed Zone — pick one or more zones to let the account sign in only there. Leave it empty to allow every zone.
   • Allowed MAC — the device MAC addresses this account is tied to, separated by commas (for example AA:BB:CC:DD:EE:FF). Used only when MAC Auto Register is on; see Tying an account to its devices.
   • Site Name and Remark — your own notes. The guest never sees them.
4. Click Save.

The account can sign in straight away.

Finding and viewing an account

The Users list searches across username, full name, email and phone at once, so you can type whatever the guest gives you. Use the search options to filter by profile, auth type, how the account signed up, or status.

Select a row and click View (or double-click it) to open the account's full picture:

• The figures at the top: Quota Used, Session Used and Login Count.
• Account — identity, dates (activated, expiry, last login and logout, last reset), authentication type, allowed zones and notes.
• Profile — the limits it has now. Profile Subscription is the plan you gave it; Profile Current is the one in force. They differ when the account has run out and moved on to the profile's advance profile. When the profile resets on a schedule, Auto Reset shows the current period and the next reset.
• Device — every device the account has signed in from.
• Sessions — who is online right now (Active now), past sessions (Login records, the last 7 days by default, up to 30 at a time) and the login methods the account has used.
• Access — the devices that sign back in automatically by MAC address or browser fingerprint, and any WiFi certificates issued to the account.

Other tabs appear only when they apply, for example Subtenants, payments, ISP or App Usage (application traffic, for accounts online on a UniFi Console controller; shown only when your organisation has one).

Changing an account or its password

1. Select the account and click Edit (or click Edit inside the account view).
2. Change what you need and click Save.

• Resetting a password: type the new password in Password. Leave it empty to keep the current one.
• Username: can be changed only until the account first signs in. After that it is locked; create a new account if the name must change.
• Profile: the new profile applies from the account's next sign-in. To change the limits of a guest who is online now, see Changing a live session's profile.

Tying an account to its devices (MAC Auto Register)

MAC Auto Register, on Portals › Captive Portal › Configuration, limits each account or voucher to the devices it first signs in from. It is off until you switch it on.

When it is on:

1. Each time an account signs in successfully on the captive portal from a new device, Kiwire adds that device's MAC address to the account's Allowed MAC list.
2. This continues until the list holds Maximum number of MAC Address to be registered per account in the same MAC Registration settings. It takes 1 to 10; an empty box means 10.
3. Once the list is full, any other device is refused with "Your device is not authorized to access WiFi." The devices on the list keep working.

To let a guest use a new phone after the list is full:

• User account: Edit the account, remove the old device's address from Allowed MAC (or clear the field so the next devices register again) and Save.
• Voucher: in the All vouchers view, select the voucher and click Reset MAC. Its list is emptied and the next devices to sign in are registered again.

While MAC Auto Register is off, the Allowed MAC list is neither filled nor checked.

Suspending an account

On the Users page, open Edit, set Status to Suspended and click Save. Any session the account has running is disconnected straight away — the save message says how many — and the guest's next sign-in is refused with "Your account has been suspended. Please contact venue staff for assistance." Setting Status to Expired disconnects in the same way. Set it back to Active to restore access.

Resetting usage

Reset gives an account a fresh start: it disconnects any live session, sets data used, time used and login count back to zero, clears the activation and last-login dates, and sets the status to Active. Use it when a guest has used up their allowance and you want to give them the same again.

1. Select the account and click Reset.
2. Click Reset User to confirm. The message says how many live sessions were disconnected.

Disconnecting a guest or changing a live session

Disconnecting is done from the live session list, not from the account:

1. Go to Reporting › Login › Active Session.
2. Find the guest's session — narrow it by zone, or type the username or MAC address into the table's search box.
3. Click the eye button on the row (or double-click the row) to open the session.
4. Click Disconnect and confirm with Yes, disconnect. Kiwire tells the controller to end the session; the guest sees the portal again the next time they browse.

In the same panel, Change Profile moves the live session to another profile without disconnecting it: choose the new profile and click Apply. This needs a controller that accepts RADIUS change-of-authorization (CoA).

Reset, Delete, suspending or expiring an account in Edit, a voucher's Suspend and Bulk Update's suspend and reset actions all disconnect live sessions for you.

Deleting an account

1. Select the account and click Delete.
2. Confirm with Delete.

Any live session is disconnected first. Deleting is permanent: the account is removed, and its name becomes free for someone else. If you may want the account back, suspend it instead.

Changing accounts on a schedule

To have Kiwire change accounts by itself on a schedule — for example suspend, delete or give a new password to a group of accounts every month — use the Account Policy tab on Portals › Captive Portal › Configuration. Each policy picks the accounts or vouchers with filters (status, profile, username, email, phone) and runs daily, weekly, monthly or yearly. See Account Policy.

Importing accounts from a spreadsheet

Use Import to create many accounts at once from a CSV file — for example a staff or student list.

1. On Account › Users, click Import.
2. Click Download Template for a file with the right column headings, and fill it in. Excel's CSV UTF-8 format works.
3. Choose the file (.csv or .txt, up to 2 MB) and click Import.

The first row must hold the column headings. The columns are:

Column	Required	What to put
username	Yes	The sign-in name. Same rules as on the form.
profile_subs	Yes	The profile's name (or profile).
password	No	At least 6 characters. If you leave it out, the account is created with no password and cannot sign in with a username and password until you set one in Edit — useful only for accounts that sign in by OTP or social login.
fullname, email_address, phone_number	No	Contact details.
status	No	active (the default), expired or suspended.
integration	No	int (the default, internal password), pms, bc, msad (Active Directory) or ldap.
allowed_zone	No	Zone names, separated by commas.
allowed_mac	No	Device MAC addresses for the account's Allowed MAC list, separated by commas (for example AA:BB:CC:DD:EE:FF). Used only when MAC Auto Register is on. A value that is not a MAC address fails the row.
date_expiry	No	YYYY-MM-DD or YYYY-MM-DD HH:MM, in your site's time zone.
site_name, remark	No	Your notes.

A results window lists every row as it is processed, with totals for Imported, Skipped and Failed:

• Skipped — the username already exists (existing accounts are never changed by an import), or the row has no username.
• Failed — the row has a problem, explained in the Note column: an unknown profile, zone, status or auth type, a value in allowed_mac that is not a MAC address, a short password, an unreadable date, or masked personal details (see below). Fix those rows and import the file again; the rows that were imported are skipped the second time.

Exporting accounts

On Account › Users, filter or search the list if you want only some accounts, then click Export. You get a CSV of exactly the accounts the list is showing, with the same column headings the import uses, so the file can be edited and imported elsewhere.

Passwords are never exported. If personal data masking is on and your role cannot see full details, the export holds masked names, emails and phone numbers, and such a file is refused if you try to import it.

Generating vouchers

Vouchers are created from the Add Voucher button at the top of Account › Vouchers. Choose one of two ways:

Auto Generate — a batch of codes

1. Click Add Voucher and keep Auto Generate selected.
2. Fill in:
   • Prefix — the start of every code. Letters, digits, dot, dash and underscore. It is pre-filled with your default voucher prefix (see Settings); change it if you like. Kiwire adds 8 random letters and digits after it, so prefix CAFE gives codes such as CAFE7K2M9QXA.
   • Quantity — how many codes, up to 100,000 in one batch.
   • Profile — the plan every code in the batch gets.
3. If the codes are for a group visit, fill in Group / batch name, Visit date and Number of people — see Counting group visits with vouchers. A batch name is worth adding anyway: it is what you will recognise later on the Batches view.
4. Open Advanced Configuration if you need:
   • Allowed Zone — only these zones accept the codes. Leave it empty for all zones.
   • Expiry Date — no code in the batch works after this date and time. It must be in the future.
   • Remark — your own note, printed on slips if your slip layout includes it.
5. Click Save.

Small batches appear almost at once. Large ones are made in the background: a progress bar shows how far it has got, and you can carry on working or leave the page. When the batch is ready, a message says "Vouchers ready — click here to print slips." Click it to print the whole batch.

Give Username — one code you choose

1. Click Add Voucher and select Give Username.
2. Type the Voucher Code — 4 to 64 characters, letters, digits, dot, dash and underscore, starting with a letter or digit. It is saved in capitals.
3. Choose the Profile and any zones, expiry date or remark, and click Save.

Use this for a memorable code such as WEDDING2026, or one shared code for a whole group (add the group details and it is counted as a group visit). The code cannot be changed after it is created.

How long a voucher lasts

Two things decide it:

• The expiry date on the voucher, if you set one. After that date the code is refused, used or not.
• The profile. A countdown profile gives a fixed amount of time or data; an expiration profile starts its clock at the first sign-in, so an unused voucher in a drawer does not run down. See Profiles, bandwidth and quotas.

Working with batches

Account › Vouchers opens on the Batches view: one row per batch, so a site that printed 100,000 codes sees a few dozen rows rather than 100,000. The figures across the top show the totals for all batches: Vouchers, Unused, In use and Expired.

Each row shows the batch name and number (for example VC00000012), the profile and prefix, how many codes it holds, a Usage bar (in use, expired, suspended, and how many are still unused), the expiry, who created it and when, and when a code from it was last used. Vouchers created one at a time without group details are gathered in a row called Individual vouchers.

Tick With unused / active only to hide batches that are finished.

Select a batch and click Manage batch (or double-click it). The panel shows the batch's counts and offers:

Action	What it does
View the vouchers in this batch	Switches to the All vouchers view filtered to this batch.
Print slips for unused vouchers	Opens a printable page of the codes not yet used.
Export batch (CSV)	Downloads every code in the batch.
Extend expiry by … days	Adds the days to the expiry date of every voucher in the batch that has one. Vouchers that had expired because of the date become active again.
Group details	The batch name, visit date and number of people. Change them and click Save.
Suspend all unused vouchers	Stops every code that has never been used from working, for example a stack of printed slips that went missing. Codes already in use are not touched.
Re-activate suspended vouchers	Makes every suspended code in the batch active again.
Delete all unused vouchers	Permanently removes every code in the batch that has never been used. Used codes stay, so your reports still count them.

Suspend and delete ask you to confirm first. Every batch action is recorded in the audit trail.

Finding one voucher

When a guest hands you a code, type the first few characters into Find a voucher code… above the list. Matching codes appear with their status, profile, batch and expiry; click one to open it.

The voucher view shows the code, its batch (with how much of the batch is used), usage, the profile, the devices that used it, live and past sessions, and — when there is any — the History of changes made to it.

To work with individual codes in a list, open the All vouchers view. Select a voucher and use:

Button	What it does
View	Opens the voucher.
Edit	Changes the Profile, Allowed Zone, Expiry Date and Remark. The code itself cannot be changed.
Suspend	Stops the voucher working and disconnects anyone online with it. Vouchers are not deleted one at a time; to remove unused codes, use Delete all unused vouchers on the batch. To bring a suspended code back, use Re-activate suspended vouchers on its batch.
Reset	Disconnects anyone using it and sets its usage back to zero, so it works as if new. If its profile starts the clock at first sign-in, the clock starts again.
Reset MAC	Empties the voucher's list of registered devices, so it can be used on new devices when MAC Auto Register is on (see Tying an account to its devices).

Printing and exporting codes

Print Slip at the top of the Vouchers page prints or exports every voucher on your site:

• Print A4 — One Column and Print A4 — Two Column — slips for an office printer.
• Print POS Slip — narrow slips for a receipt printer.
• Print QR — Two Column — each slip with a QR code of the voucher code.
• Export — a CSV with Username, Password, Validity, Expiry Date and Remark for every voucher, to print elsewhere or send to a reseller.

The print page opens in a new tab and opens your browser's print dialog. One print page holds at most 5,000 vouchers; for more, print batch by batch from Manage batch, which prints only the unused codes.

What a slip looks like

The layout comes from the Voucher Template setting on Admin › System › Settings › Voucher & Topup. It lists the message templates of type voucher, which you design under Grow › Messages › Message Template. A template can use these placeholders: {{voucher_code}}, {{username}}, {{password}}, {{validity}} (from the profile, for example "30 days"), {{date_expiry}}, {{remark}} and {{logo}} (your site logo). With no template chosen, each slip shows the voucher code, password, validity and expiry date.

Top-up codes

A top-up code adds time and/or data to an account that already exists — a user or a voucher. Typical uses: selling extra data at the front desk, or giving a guest an extra hour without creating a new account.

Switch top-ups on first

Top-ups are off until you allow them. On Admin › System › Settings, open Voucher & Topup and switch on:

• Allow Topup Account / User — to top up user accounts.
• Allow Topup Voucher — to top up vouchers.

While a switch is off, a code cannot be redeemed onto that kind of account, by staff or by a guest.

Generating top-up codes

1. Go to Account › Topup Code and click Create.
2. Fill in:
   • Prefix — the start of every code, pre-filled with your default top-up prefix. Up to 12 characters: letters, digits, dot, dash and underscore.
   • Plan Name — what the guest and your staff see, for example 1 Hr Plan or 1 GB Data.
3. Open Advanced Configuration:
   • Quantity — up to 500 codes at a time.
   • Code Length — how many random characters follow the prefix, from 8 to 20. The prefix and the code length together must be 20 characters or fewer, for example a 4-letter prefix with a code length of 10; otherwise the form refuses with "Prefix plus code length must be 20 characters or fewer".
   • Session Time (minutes) and/or Quota (MB) — what each code adds. At least one must be more than zero. The converter under each box turns hours, days or months (for time) or KB, MB or GB (for data) into the right figure — enter a value, choose the unit and click the button beside it to fill the field.
   • Price — the face value, for your records and reports. Kiwire does not charge it.
   • Expiry Date — the last moment the code can be redeemed.
   • Remark — your own note.
4. Click Save.

The new codes appear on the list. Top-up codes have no print page; give the guest the code shown in the Code column. Search by Plan Name or filter by status to find the codes from one run.

How a guest redeems a code

The guest needs a portal page with the Top-up login method on it (Portals › Captive Portal › Login Methods; see Login methods). On that page the guest enters:

• their username — or, for a voucher, the voucher code;
• their password — a voucher can leave this empty;
• the top-up code.

The time and data are added to the account at once. Depending on the method's Log the guest in after the top-up switch, the guest is then connected with the new allowance, or taken to the next page of the journey (for example a confirmation) without signing in.

A code is refused if it has already been used, has expired, or the account is not active.

Redeeming a code for a guest

Staff can apply a code for a guest who phones or walks up to the desk:

1. On Account › Topup Code, select the code and click View.
2. Under Redeem for an account, type the guest's username or voucher code and click Redeem.

The code's time and data are added to the account as bonus credit on top of its profile, and the code is marked used. Redeemed by then shows who received it and when.

Undoing a top-up

Select the code and click Reset, then Reset Code. The code becomes unused again and the time and data it added are taken back off the account, so a code can never be credited twice.

A redeemed code cannot be deleted — it is the record of who received the credit. Reset it first if you really want to remove it. Edit changes the plan name, time, data, price, expiry and remark of codes not yet given out; it does not change credit already added to an account.

Changing many accounts at once (Bulk Update)

Account › Bulk Update applies the same change to many users and vouchers at once — moving everyone onto a new profile, extending a set of accounts, or suspending a group.

1. Choose All, Accounts or Vouchers, a status if you want, and search by username to narrow the list.
2. Select the accounts: click rows, or Select page for every row on the page. To change everything the filter matches across all pages, click All … matching.
3. Under Fields to Update, switch on only the fields you want to change:
   • Status — Active or Suspended.
   • Profile — the new profile.
   • Allowed Zone — a zone, or — Any zone (clear restriction) —.
   • Expiry Date — Set date for one date for everyone, or Extend to add a number of days to each account's own expiry (counted from today for accounts with no expiry or already expired).
   • Remark — Replace the remark, or Append text to it.
4. Under Reset Actions, tick any of Reset Quota, Reset Session, Reset Logins and Clear Activation (which also sets the status to active).
5. Click Apply Changes and confirm with Yes, apply.

Limits: up to 250 selected accounts, or up to 5,000 with All … matching. For more, narrow the filter and run it in parts. If the number of matching accounts changes between your look and your click, Kiwire stops and asks you to refresh, so you never change accounts you did not see.

Suspending, and any reset action, disconnects the affected guests who are online. A profile change applies from each guest's next sign-in. Every changed account is recorded in the audit trail, and the change cannot be undone in one step.

How a profile reaches a guest

A guest's limits come from one of three places:

• The account. The Profile you choose on a user or voucher, or set with Bulk Update or an import.
• The login method. Accounts created by sign-up, social, OTP and payment methods get the profile set on that method, or the plan the guest bought.
• The zone. A zone with a forced profile applies that profile to every sign-in there, whatever the account has.

When an account uses up its allowance, it can move on to the profile's advance profile; the account's Profile tab then shows a different Profile Current. Details are in Profiles, bandwidth and quotas.

WiFi certificates

Account › WiFi Certificate lists the certificates issued to devices that connect to your WiFi Enterprise (802.1X) network by certificate. Certificates are not made here: guests and staff create them for their own devices in the User Portal, once a portal configuration has Enable Certificate Panel switched on. On this page you can View a certificate's details, validity, download information and the owner's usage, or Delete it — for example for a lost or retired device. The password the owner chose for the certificate is never shown; View only says Set by the user (not shown). Deleting removes the certificate and its download files; it no longer lets its device sign in, and the owner can create a new one. How long a certificate lasts is the Certificate Expiry on the WiFi Enterprise login method the owner signed in with. See Login methods for how certificate login fits with the rest of WiFi Enterprise.

What a guest sees

• User accounts sign in on a portal page with the Default Login method: username and password.
• Vouchers sign in on a page with the Voucher Login method: the guest types the code, nothing else.
• Top-up codes are entered on a page with the Top-up method, as described above.
• A Check Usage page lets guests look up their own remaining time and data.

When a sign-in is refused, the guest sees a plain message, for example:

Situation	The guest sees
Wrong voucher code	"Invalid voucher code. Please check the code and try again."
Wrong username or password	"Incorrect username or password. Please check your details and try again."
Account or voucher suspended	"Your account has been suspended. Please contact venue staff for assistance."
Past its expiry date	"Your account has expired. Please contact venue staff to renew access."
Not allowed in this zone	"Your account is not authorized to access WiFi from this location. Please contact venue staff."
Time or data used up	"You have reached your session time limit…" or "You have reached your data quota limit…"
Too many devices at once	"You have reached the maximum number of simultaneous connections."

The full list is in Portal error codes.

Settings that affect vouchers and top-ups

On Admin › System › Settings, the Voucher & Topup card holds:

Setting	Effect
Default Prefix (voucher)	Pre-fills Prefix when you generate vouchers, and is the prefix used for vouchers sold through the Buy Panel.
Voucher Template	The slip layout used when printing vouchers.
Default Prefix (top-up)	Pre-fills Prefix when you generate top-up codes.
Allow Topup Voucher / Allow Topup Account / User	Whether top-up codes can be redeemed onto vouchers and onto user accounts. Both are off until you switch them on.

On the General card, Clear password change date on reset makes Reset also restart the password-age rules for the account. See Settings, card by card.

If something goes wrong

Problem	What to check
The Profile list is empty	No profiles exist yet. Create one under Account › Profiles.
A guest cannot sign in and you cannot see why	Run the account through Portals › Troubleshoot › Diagnostic Account. It goes through the same checks as a real sign-in and names the one that fails.
"Voucher code already exists"	The code is already a voucher or a username on your site. Choose another.
"The expiry date must be in the future"	Expiry dates on new vouchers and top-up codes cannot be in the past.
A suspended user is still online	Suspending in Edit disconnects live sessions; if the save message reported none disconnected but the guest still shows online, the controller didn't accept the disconnect. End the session in Reporting › Login › Active Session, or check the controller's CoA / disconnect settings.
"Your device is not authorized to access WiFi."	MAC Auto Register is on and the account's Allowed MAC list is full. Edit the list (users) or click Reset MAC (vouchers).
A batch shows +N still generating	The background generation is still running. The row fills in as the codes are made.
Print Slip says there are too many vouchers	One print page holds 5,000 slips. Print from Manage batch instead.
A top-up is refused with "switched off for this tenant"	Switch on Allow Topup Voucher or Allow Topup Account / User under Voucher & Topup in Settings.
A top-up is refused because the account is not active	Only an active account can be topped up. Reactivate or reset it first.
Generating top-up codes fails	Make sure the prefix (up to 12 characters) plus Code Length is 20 characters or fewer, and that the code carries time or quota.
Imported rows say "Profile … not found"	The profile_subs column must hold the profile's exact name as shown on Account › Profiles.

Who can do what

Each page has its own permissions, set on Admin › System › Roles:

Page	View	Create	Change	Remove
Users	view-users (also Export)	create-users	edit-users — edit, reset, import	delete-users
Vouchers	view-vouchers (also print and export)	create-vouchers	edit-vouchers — edit and batch actions; reset-vouchers — reset, Reset MAC	delete-vouchers — suspend, delete unused
Topup Code	view-topup-codes	create-topup-codes	edit-topup-codes — edit, reset, redeem	delete-topup-codes
Bulk Update	bulk-update-accounts
WiFi Certificate	view-wifi-certificates			delete-wifi-certificates

Approving or declining a guest's QR Login code needs create-vouchers. Disconnecting a guest and Change Profile on Reporting › Login › Active Session need manage-report-login-active-session. Buttons a role cannot use are hidden.

If personal data masking is on, roles without View personal data (unmasked) see masked names, emails and phone numbers on the Users page and in its export, and cannot change those fields. The Vouchers and Topup Code pages are not masked.

Related

• Account, voucher and top-up fields — every field, in full
• Counting group visits with vouchers
• Profiles, bandwidth and quotas
• Hiding guests' personal details from staff
• Login methods
• Portal error codes
• Menu tour: Users, Vouchers, Topup Code, Bulk Update, WiFi Certificate, Diagnostic Account