WiFi Vouchers 1.7: your API key behind your own proxy

Ever since we released WiFi Vouchers for UniFi, one question kept coming back: “You want me to give an app my UniFi API key?”

It is a fair question. A UniFi Network Integration API key inherits every right of the admin account that created it, and Ubiquiti offers no way to restrict one to a subset of endpoints. So “just give the voucher app an API key” means, in practice: hand it your whole console. Refusing that is a perfectly reasonable position.

Version 1.7.0 has an answer for it.

The proxy is the missing scope

Alongside the update we released unifi-voucher-proxy: a small service you run on hardware you control. It holds the real API key. Clients — the iPhone at the reception desk, say — get their own token that can do exactly four things:

• list sites

• list vouchers

• create vouchers

• revoke vouchers

Every other path answers 403 — and produces no traffic to your controller at all. There is deliberately no generic path forwarder: every call the proxy can make upstream is a named method in a single file.

On top of that comes everything an API key cannot do by itself: a site allowlist per token (a token restricted to one site cannot even see that the others exist), quotas for batch size and validity, rate limits per token and per IP, and an audit log where every line carries the name of the token that caused it.

The tokens themselves live in the config only as Argon2id hashes, so a copied config file is not a working credential.

And, while we were at it: certificate pinning

UniFi consoles ship a self-signed certificate. Ordinary verification therefore always fails, and most tools solve that by turning verification off entirely. That leaves the API key exposed to anyone who can ARP-spoof the console’s address — on a guest network, that is a meaningful set of people.

The proxy pins your console’s fingerprint instead, and from then on talks only to that exact certificate.

It is written in Rust: no runtime dependencies, roughly a 5 MB container. It speaks REST (path-compatible with the UniFi Integration API) and GraphQL, is MIT-licensed and open source — you do not have to take our word for any of it.

Set up in three commands

The proxy runs as a single binary or as a container. Setting it up is essentially three steps:

Then, in the app, open Add a controller, switch to Via proxy and enter the address and your token. The paths are identical to the Integration API, so nothing else changes.

One detail that is genuinely nice in daily use: on connecting, the app asks what the token is allowed to do and adapts. A read-only token gets no create button, a token without revoke permission gets no revoke controls, and the batch slider stops at the maximum you configured in the proxy.

What else is in 1.7

• Face ID / Touch ID — an optional lock for the app, for when the device at the front desk sometimes sits around unattended.

• Home-screen widget for iOS — styled like the app, for the voucher you need in passing.

• Editable validity presets — your own durations instead of our suggestions.

• A WiFi join card to share, plus the usual bug fixes.

WiFi Vouchers for UniFi is still free on iPhone, macOS and Android. The proxy is optional — if you prefer the direct route to your console, change nothing and the update is just the new features.