DOCUMENTATION

Sign-in is rejected

The guest enters a valid password or voucher and still cannot get in.

Symptom

The guest types the password received by SMS or e-mail, or a voucher code, and the portal answers "sign-in failed". The guest appears under Guests in the panel, but no session starts.

Check these first

  1. Compare the shared secret in Settings → RADIUS with the one on the access device character by character: trailing spaces and letter case both count.
  2. Find the source IP the device sends RADIUS from (behind NAT it is the WAN address) and make sure that exact address is the NAS defined in Settings → RADIUS.
  3. If this guest was disconnected from the panel within the last 15 minutes, wait for the window to pass and try again.

Possible causes

Shared secret does not match

How to tell: Every attempt is rejected regardless of user. The device log mentions a bad authenticator or shared secret; the panel shows the request as invalid or not at all.

Fix: Re-enter the secret on both sides. Prefer letters and digits only; some devices mishandle quotes and special characters.

NAS not defined, or a different source address

How to tell: Requests reach Captivo but are dropped as coming from an unknown client. Typical after a WAN change, a second uplink or a new NAT device in front of the access device.

Fix: Define the NAS in Settings → RADIUS with the address the packets actually arrive from, not the device's LAN address.

PAP / CHAP mismatch

How to tell: MikroTik mostly: the password is right, every attempt is rejected, and the hotspot profile has CHAP enabled.

Fix: Captivo authenticates with PAP. Enable PAP in the hotspot profile as described in the MikroTik guide.

The portal file belongs to another tenant

How to tell: Cloud only. The username in the request carries a prefix such as other-venue_, or no prefix at all, while your tenant's prefix is different.

Fix: The uploaded portal file was downloaded from another tenant's panel. Download it again from your own Settings → Portal and replace it on the device.

Temporary reject: the guest was just disconnected

How to tell: A guest whose session was terminated from Active Sessions cannot sign in again right away, then can after about 15 minutes.

Fix: Expected: a terminated local user or voucher is refused for 15 minutes so the device cannot silently reconnect. On-prem the window is the server setting RADIUS_KICK_MINUTES.

The credential has expired

How to tell: A voucher shows as expired or fully used under Vouchers; an SMS password is tried long after it was sent; a local user is disabled.

Fix: Check the voucher's status and limits under Vouchers. A guest password is valid for a limited window after it is sent (15 minutes by default, set under Settings → Portal); ask the guest to request a new one. Enable the local user if it was disabled.

The MAC allow-list entry has expired

How to tell: A device that used to skip the portal now lands on it, or is rejected when the device tries MAC authentication.

Fix: Open Settings → MAC Whitelist and check the entry's expiry date; expired entries are deactivated automatically. Extend or re-add it.

If it is still not solved

  • The username or phone number that was rejected, and the exact time
  • Access device model and firmware version
  • The device's RADIUS log line for the attempt
  • Whether other guests can sign in at the same time
  • Cloud or on-prem, and the tenant name

Was this article helpful?