Login Methods

Login Methods configure how guests authenticate on your captive portal. Kiwire supports multiple authentication types that can be enabled simultaneously — guests see the methods enabled for their Journey as tabs or buttons on the portal login page.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/login-method/overview.png

Available Login Method Types

Type	Description	Prerequisites
username-password	Traditional username and password login using credentials from the Kiwire user account database.	None — built-in to Kiwire.
social-google	Guests sign in with their Google account via OAuth 2.0. A Kiwire user account is created on first login.	Google OAuth connector configured.
social-facebook	Guests sign in with their Facebook account via OAuth. A Kiwire user account is created on first login.	Facebook OAuth connector configured.
sms-otp	Guest enters their phone number; Kiwire sends a one-time password via SMS. No prior account required.	SMS connector configured and active.
voucher	Guest enters a voucher code. Access duration and bandwidth are determined by the voucher's assigned profile.	Vouchers must be pre-generated in the Vouchers module.
click-to-connect	No credentials required. Guest clicks a single button to accept terms of service and is granted immediate access.	None. A profile must be selected for auto-assignment.
whatsapp-otp	Guest enters their phone number; Kiwire sends an OTP via WhatsApp. No prior account required.	WhatsApp connector configured and active.
registered-account	Enterprise registered account login for employees. Validates credentials against the Kiwire enterprise user directory.	Wifi Enterprise module enabled.

Method Configuration

Each method has its own configuration panel. Click a method card to expand its settings:

Enable Toggle

The global Enable toggle at the top of each method card controls whether the method is available tenant-wide. If disabled here, no Journey can use this method — Journey-level toggles are overridden.

Display Order

Drag method cards to reorder them. The order set here is the default order used in all Journeys. Individual Journeys can override the order for their specific portal page.

Button Label & Appearance

Customise the button or tab label shown on the portal page (e.g., rename "Username / Password" to "Member Login"). You can also set a button background colour and icon override per method.

Auto-Registration

Social login methods (social-google, social-facebook) and OTP methods (sms-otp, whatsapp-otp) support auto-registration. When enabled, a new Kiwire user account is automatically created the first time a guest authenticates via that method. On subsequent logins, the existing account is matched.

When auto-registration is disabled, only guests who already have a Kiwire account (created manually or via import) can use the method — the portal will reject unknown identities.

Profile Assignment

For methods that auto-create accounts (click-to-connect, social logins, OTP), you must select a default access profile. New accounts created via the method are automatically assigned this profile, which determines their bandwidth, session time, and data quota.

If the guest already has an account with a different profile, their existing profile is respected — the method's default profile only applies to brand-new accounts.

MAC-Based Auto-Login

MAC-based auto-login bypasses the portal for returning devices within a configurable time window. When enabled for a method:

• After a guest's first successful login, their device MAC address is recorded
• On the next connection within the auto-login window (e.g., 30 days), the portal is skipped entirely and the guest is granted access automatically
• The window is measured from the guest's last successful login, not account creation

Configure the auto-login window (in days) in the method settings. Set to 0 to disable.

Common Settings (All Methods)

Setting	Description
Allowed Email Domains	Restrict account creation/login to specific email domains (e.g., company.com). Comma-separated. Leave blank to allow all.
Blacklist Domains	Block specific email domains from registering or logging in. Checked after the allow list.
Blacklist Emails	Block specific individual email addresses.
Account Expiry on Create	Set an expiry duration for auto-created accounts (e.g., 30 days from creation). Accounts created via this method expire after this period.
Allow Email Collection	Whether to prompt or require an email address during registration for methods that don't inherently collect it.
Auto-Activate	If enabled, new accounts are immediately active. If disabled, accounts are created in inactive status and must be manually approved.

Social Login Configuration

Google and Facebook OAuth require application credentials configured in the respective Connector modules (Connectors → Google OAuth or Facebook OAuth). The Login Methods page does not store OAuth keys directly — it references the connector.

If the connector is not configured, the social method's enable toggle will display a warning and the method cannot be activated.

Required Permissions

view-login-methods · update-login-methods