Configuration
The Captive Portal Configuration page holds global settings that apply across all Journeys for your tenant. These are the foundational parameters that control how your portal operates — from the public domain guests are redirected to, through session handling, to branding defaults.
'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}public/assets/img/docs/portal-configuration/overview.png
General Settings
| Setting | Description |
|---|---|
| Portal Domain / FQDN | The publicly accessible domain name or IP that guests are redirected to when their traffic is intercepted (e.g., portal.yourcompany.com). This is the URL the guest sees in their browser address bar on the captive portal page. |
| Walled Garden IPs | A list of IP addresses or CIDR ranges that guests can reach before completing authentication (e.g., your portal server IP, payment gateway, DNS servers). Comma or newline separated. |
| Session Check Interval | How often (in seconds) the portal heartbeat re-validates that the guest's session is still active. Lower values detect disconnection faster but increase server load. Default: 60 seconds. |
| Simultaneous Device Limit | Maximum number of concurrent devices a single user account can have active at one time. Set to 0 for unlimited. When the limit is reached, the oldest session is disconnected. |
| MAC Binding | When enabled, a session is tied to the device's MAC address at login. If the MAC changes mid-session (e.g., MAC randomisation), the session is invalidated. Recommended for tighter security. |
The Portal Domain must match the domain configured in your network controller's captive portal redirect rules. A mismatch causes redirect loops or SSL certificate errors for guests.
Branding Settings
These settings provide tenant-level branding defaults. Individual portal templates (built in Portal Designer) can override them — these values serve as the fallback when a template does not specify its own branding.
| Setting | Description |
|---|---|
| Favicon | The browser tab icon for the captive portal. Upload a .ico, .png, or .svg file (recommended: 32×32 px). Displayed in the guest's browser tab. |
| Browser Tab Title | The <title> shown in the guest's browser tab (e.g., "Hotel WiFi — Please Sign In"). Supports the {{tenant_name}} variable. |
| Fallback Logo | A logo image used on the portal if the assigned template does not include a logo element. Accepted formats: PNG, JPG, SVG. Recommended: transparent background PNG. |
Redirect Behaviour
| Setting | Description |
|---|---|
| Global Redirect URL | Where guests are sent after a successful login. This is the tenant-wide default. Individual Journeys can override this with their own redirect URL. Leave blank to redirect the guest to the original URL they were trying to reach. |
| Redirect Delay | Number of seconds to wait on the success page before performing the redirect. A short delay (e.g., 3–5 seconds) gives the guest time to read the success message. Set to 0 for immediate redirect. |
Set the Global Redirect URL to your organisation's website or a welcome landing page. This gives guests a consistent first experience regardless of which URL they originally requested.
Social Login Settings
If your Google or Facebook OAuth credentials are shared across all Journeys (rather than being configured per-connector), you can set global client IDs and secrets here. These values are used as a fallback when the dedicated OAuth connector does not have credentials configured.
| Setting | Description |
|---|---|
| Google Client ID | The OAuth 2.0 Client ID from your Google Cloud Console application. |
| Google Client Secret | The OAuth 2.0 Client Secret. Stored encrypted at rest. |
| Facebook App ID | The App ID from your Meta for Developers application. |
| Facebook App Secret | The App Secret from Meta for Developers. Stored encrypted at rest. |
It is recommended to configure OAuth credentials in the dedicated Connectors → Google OAuth and Connectors → Facebook OAuth modules rather than here. The connector approach allows per-connector scoping and easier rotation of credentials.
Saving Changes
All configuration settings on this page are saved together with the Save button at the bottom of the form. Changes take effect immediately — no service restart is required. Currently connected guest sessions are not interrupted by configuration changes.
Changing the Portal Domain will break existing guest sessions and all active redirect rules on your network controllers. Only update this setting during a planned maintenance window.
Required Permissions
view-portal-config · update-portal-config