Book a demo

For developers

Everything we have, exposed.

Your own guest login app. Your own onboarding flow. Your own paid WiFi. A captive portal API and guest WiFi API in one: fourteen REST endpoints, JSON in and out, to create locations, configure networks, register devices, log guests in and collect mobile money.

The external API is in private beta. The samples on this page show the request shape; the base URL and your keys arrive together.

$HALO_API
$ curl -s "$HALO_API/external/locations" -H "Authorization: Bearer eyJ…"
● 200 OK · 84 ms
{
  "locations": [{
    "id": "9f2c-…-84hz",
    "name": "The Sentinel Hotel",
    "networks": 3,
    "devices_online": 24
  }, …]
}
$
  • POST/external/token
  • GET/external/locations
  • POST/connect/external/trigger-login
  • POST/external/payments/collect
  • GET/external/payments/{uuid}/status
Get API accessSee it on the features page

REST · JSON · Bearer auth · sandbox venue included

What people build

Our box. Your product.

We handle thousands of guest logins a day through our portal. When operators outgrow it — or never wanted it — they build on the API instead.

Guest login apps

Your app, your onboarding, your brand from the first pixel. One API call puts the guest online — our portal never appears.

Provisioning at scale

Create the location, configure its network, register the routers — new venues onboard from your own back office, not ours.

Branded rollouts

Push logo, banner and background per location straight from your asset pipeline. A hundred portals, one script.

Paid WiFi, mobile money

Send an MTN or Airtel prompt to the guest’s phone, poll until it settles, let them through. Uganda-ready out of the box.

The surface

Fourteen endpoints. Five groups.

Grouped by resource, one Bearer token for nearly all of it. This is the whole surface — what you see here is what ships.

AuthenticationStart here. Exchange your API key and secret for a Bearer token.
POST/external/token
LocationsVenues you manage — list them with their networks, read one, create one, brand one.
GET/external/locationsGET/external/location/{id}POST/external/locations/addPOST/external/location/{id}/branding
NetworkingSSIDs and devices — configure or reactivate the network, register routers and APs, edit them.
POST/external/location/{id}/networkingPOST/external/location/{id}/networking-devices/addPUT/external/location/{id}/networking-device/{uuid}
Guest loginThe captive-portal hand-off: see the login apps a network offers, then log the guest on from your own.
POST/external/guest-login-appsPOST/connect/external/trigger-login
PaymentsMobile money, MTN and Airtel Uganda: prompt a phone, poll to settled, verify the payer. KYC lookup and the wallet QR need no auth at all.
POST/external/payments/collectGET/external/payments/{uuid}/statusGET/external/payments/{wallet_uuid}/{uuid}/kycGET/external/payments/{wallet_uuid}/qr

Full endpoint reference ships with your keys. · Request access →

Two calls, whole story

Token in. Guest online.

once, from your backend
# Exchange your key pair for a Bearer token. HALO_API arrives with your keys.
curl -X POST "$HALO_API/external/token" \
  -d key="halo_pk_…" \
  -d secret="halo_sk_…"

{
  "token_type": "Bearer",
  "token":      "eyJhbGciOiJIUzI1…"
}
# Shown once — store it.
your login app puts the guest online
# Guest taps “Connect” in your app:
curl -X POST "$HALO_API/connect/external/trigger-login" \
  -H "Authorization: Bearer eyJ…" \
  -d mac="ac:37:43:9b:1f:02" \
  -d location="9f2c-…-84hz"

{
  "status": "online"
}
# Our portal never appeared.

Proof

Our dashboard is just another client.

The fleet board below — every venue with its networks and device counts — is the same GET /external/locations you get. Our cloud consumes the surface it serves; the endpoints on this page are the ones our own apps ride, not a brochure copy of them.

cloud.halowifi.com — built on GET /external/locations
The Halo Cloud locations grid with live session counts and a venue quick-view panel

Ground rules

Boring, in the good way.

Keys, plainly

A key and a secret from your dashboard mint a Bearer token at /external/token. The token is shown once; rotate the pair any time.

Sandbox venue

Every account gets a fake venue with fake guests generating real-shaped data. Break it all you like.

Stable paths

Everything lives under /external and stays there. We deprecate with notice, not surprises.

Honest limits

Rate limits exist and are printed on every response header, so you can plan around them.

Plain errors

JSON errors that say what went wrong and what to do about it. No error code scavenger hunts.

$0, also

The API is part of the product, not an upsell. Same rule as every feature: if we build it, you have it.

Build on it.

Tell us what you’re making and we’ll send keys, the endpoint reference and a sandbox venue — usually the same day.

Get API access

Rather see the product first? Book a demo