Skip to main content

ISP OAuth and AAA Setup

This guide is specific to ISPs and NSPs that already operate their own identity gateway.

Captive portals remain hosted locally on the client's own network gateway. Complete the OAuth onboarding prerequisites first, then point your captive portal at the returned WispHive URLs.

Registration prerequisites​

An ISP registration must exist first. The registration record provides:

  • company_name
  • company_email
  • country
  • phone_number

Choosing a mode​

OAuth integration prerequisites:

  1. Complete OAuth integration setup.
  2. Confirm callback and redirect flow success.
  3. Point your captive portal at the returned WispHive URLs.

Hosted OAuth​

Choose hosted OAuth when you want captive portal logins to begin on a WispHive auth domain and your provider supports confidential-client flows.

AAA handoff​

Choose AAA handoff when you already have a production login URL and only need to POST the authenticated user back to WispHive for redirect/session orchestration.

  1. The captive portal uses your own OAuth login URL.
  2. Your OAuth backend authenticates the subscriber.
  3. Your backend POSTs only the assigned derived identifiers to the WispHive callback_url.
  4. WispHive returns a short-lived redirect URL.
  5. Your flow sends the browser to that redirect URL immediately.

Example callback payload​

{
  "entity_name": "MetroFiber ISP",
  "userid": "a7df8a0f-d316-46d1-b0aa-552d5d886d34",
  "derived_username": "metrofiber-45ef6-subscriber-7812",
  "derived_email": "metrofiber-45ef6-subscriber-7812@metrofiber-45ef6.id.wisphive.net",
  "user_session_id": "sess_01J2Y8R3BFC9F4ZP2K8M1Q4R1V",
  "wisphive_token": "WH_Oid-a67d39t78sqcaRedsWte9_Kl90klhgyr37gHgfw-uiDlc35j9yUfa"
}