Omada MSPs: one hosted captive portal across client sites

An MSP with a dozen Omada client sites can give every one of them the same hosted sign-in page and guest marketing, watched from one partner login. Omada has the hook for it: an External Portal Server authentication type that hands the sign-in to an outside server, where the guest list and the marketing live.

TP-Link facts below come from its Omada support documents, checked on 22 October 2026. The click-by-click settings are on the Omada setup page and in the TP-Link Omada captive portal guide.

What Omada's built-in portal offers

Omada Controller has seven portal authentication types, according to TP-Link's guide to configuring portal authentication on Omada Controller v6.2 and above: No Authentication, Simple Password, Hotspot, RADIUS Server, External LDAP Server, External Portal Server and Google. You create a portal per site under Network Config, Authentication, Portal, and it applies to SSIDs and LAN networks.

The Hotspot type bundles several methods a venue can use on its own:

• vouchers generated by the controller for a set duration, printed and handed out
• Local User, a username and password set up on the controller
• SMS, a verification code sent to the guest's phone
• RADIUS, checking credentials held on a RADIUS server
• Form Auth, a questionnaire the administrator writes, which TP-Link says "can be used to gather feedback from customers"

The Design page customises the background, logo, text, form and advertisements, and the Access Control tab holds Pre-Authentication Access, the URLs or IP ranges guests can reach before signing in.

Omada's External Web Portal setting, under Portal Customization, is easy to confuse with External Portal Server. TP-Link describes it as a login page on an external web portal server, used with the RADIUS Server and External LDAP Server types. A hosted platform such as CaptiFi uses External Portal Server, where the portal server itself tells the controller to let the guest online.

The nearest thing to a guest list in TP-Link's guide is Form Auth, which it pitches for gathering feedback; the guide has nothing on marketing consent, campaigns, review requests or reports on returning guests.

Omada MSP mode and the cloud plans

MSP mode is TP-Link's management layer for a provider with many customers. Its guide to configuring MSP mode on Omada Controller v6 says that with it on you can add multiple customers, monitor each customer's real-time status and manage accounts across them. You switch it on under Global Settings, Controller Settings, and get an MSP view with a customer list, MSP roles for that view and Customer roles for each customer's Global and Site views. TP-Link gives an upper limit of 100 customers on Omada Controller v5 and 500 on v6.

The same guide lists MSP mode as supported on the Omada Software Controller and the Cloud-Based Controller Network Only Standard Organization, and not supported on Omada Central (network and guard systems) or the Cloud-Based Controller Essential. TP-Link's cloud controller page sets a free Essentials plan against Cloud Standard, a paid, per-device licence that adds MSP multi-customer management, advanced portal authentication and Open API access, among other things.

CaptiFi works with the OC200 and OC300 hardware controllers, the self-hosted software controller and the paid Cloud-Based Controller, and doesn't support Omada's free Central Essentials tier (formerly Cloud Essentials, renamed in May 2025), which has no external portal API. CaptiFi's Omada guide is written per site and doesn't cover MSP mode separately, so put your first client site through a full test (redirect, sign-in, guest online, guest in the dashboard) before rolling out the rest.

How CaptiFi connects to each Omada site

CaptiFi connects to each Omada site through an External Portal Server portal, four pre-authentication entries and a hotspot operator account, and each site is its own CaptiFi venue on the client's account. On the controller, per site:

1. Create a guest SSID with security set to None, Omada's Guest Network option off (it stops guests reaching the controller's portal address) and its own VLAN to keep guests away from tills and office machines.
2. Create a portal on that SSID with Authentication Type set to External Portal Server and Custom Portal Server set to URL. Choose https:// and enter app.captifi.io/guest/omada?site_id=YOUR_SITE_ID, which the set-up wizard shows with a copy button. Landing Page stays on Original URL.
3. Turn on Pre-Authentication Access and add app.captifi.io, fonts.googleapis.com and fonts.gstatic.com as URL entries and 46.62.168.7 as an IP Range entry with mask 32. Omada doesn't accept wildcards, and the page doesn't need one.
4. Under Hotspot, Operators, add an operator account for CaptiFi on that site, then enter the Controller URL, the 32-character Controller ID and the operator login on the venue in my.captifi.io.

The operator account is how guests get online. TP-Link's External Portal Server API guide for Omada Controller v6.2.10 has the portal log in with hotspot operator credentials before it authorises a client, and says they "must belong to a Hotspot Operator account created in the Controller, not a Controller administrator account". Session length is set on the CaptiFi venue, so there's no timeout to set in Omada.

CaptiFi has to reach the controller directly, so an on-site controller needs a port forward (8043 on the software controller, 443 on an OC200 or OC300), and TP-Link's remote access page won't work as the Controller URL. On Starlink Residential and Roam plans, CGNAT blocks inbound connections, so use the paid Cloud-Based Controller or a cloud-hosted software controller, or a Starlink Priority plan with a public IP.

The Open API route: let CaptiFi set up the portal

With an Admin-role Omada Open API app, CaptiFi does steps 2 and 3 for you. TP-Link's guide to creating a site through the Open API shows where apps are made: in the Global view, Settings, Platform Integration, Open API, Add New App, where you name the app and choose its Role and Site Privilege. It describes Client mode as the one for system-to-system integration.

For CaptiFi, create the app in Client mode, limit Site Privilege to the client's site (the app must see one Omada site only) and paste the Client ID and Client Secret into the venue's Connection status on my.captifi.io:

• Viewer lists the venue's access points in CaptiFi (name, model, status, last seen) and the guests connected now.
• Admin adds a Set up the portal on my controller button, which creates or updates a portal named CaptiFi on the chosen SSID and fills in missing pre-authentication entries. It also lets CaptiFi rename the guest SSID, apply the venue's download and upload limits as a rate limit profile, and disconnect a guest.

Open API is on Omada software and hardware controllers from v5.12 and on Omada 6. Four checks then sit on the venue card (Guest WiFi network chosen, Portal points at CaptiFi, Pre-authentication list and Guest Network setting), so you can check each site's portal set-up without opening the controller. You still create the operator account and connect the controller yourself.

If a client wants paid WiFi, note that CaptiFi's speed tiers are enforced on UniFi only. At an Omada venue a per-pass tier is shown to the guest and not applied, and data allowances are best effort, so sell Omada passes by duration.

Per-site checklist for Omada client venues

Run these nine steps, in order, for every client site.

If the splash page doesn't appear in step 9, a missing pre-authentication entry is the usual cause, and the guide to a captive portal not showing covers the phone-side checks.

Running Omada client sites from the fleet view

Once sites are live, you watch them from the CaptiFi partner dashboard on my.captifi.io. An Omada venue shows on the fleet overview with its controller platform and reads as online once the controller is connected. The Devices online tile counts CaptiFi devices only, so judge controller venues by their splash status, guests today and last activity.

A setup pill on each client row tracks the four go-live steps (venue created, device online, splash live, first guest connected), which makes the Clients page your installation to-do list, and the morning health digest email flags any venue that needs attention.

The Omada controller is where you change radios, VLANs and firmware for each customer. CaptiFi's fleet overview shows whether guests are signing in, and the Clients page shows each client's plan, wholesale, retail and margin, with a wholesale statement emailed on the 1st. Clients on UniFi sit in the same fleet table, and the guide for UniFi installers covers that side.

Choosing a partner model for Omada clients

If you already look after a client's Omada controller, you get the first call when the WiFi misbehaves, so reselling or white label usually fits; referral suits an introducer who wants no support work. The MSP guide to reselling and white label sets out the terms of each model, and the MSP programme page has the rate card. When a site needs CaptiFi's help, step 10 of the MSP deployment checklist lists what to send partners@captifi.io.

Before the first client site, run steps 2 to 9 of the per-site checklist on a lab controller with the 6-month demo licence venue you get on approval, so the routine is settled. To start, apply online or email partners@captifi.io.

Sources: TP-Link Omada Support, How to Configure Portal Authentication on Omada Controller (v6.2 and Above), API and Code Samples for External Portal Server (Omada Controller v6.2.10 or Above), How to Configure MSP Mode on Omada Controller v6 and How to Create Site in Omada Controller via Open API; Omada Networks, cloud-based controller page and the press release Omada Central Essentials (19 May 2025); all checked 22 October 2026. CaptiFi's partner programme pages and customer documentation, October 2026. TP-Link, Omada, Starlink, UniFi and the other product names here are trade marks of their owners; CaptiFi is not affiliated with or endorsed by them.