QuuPass communicates with your Meraki infrastructure entirely through the Meraki Dashboard API (v1). No agent software, no VPN, no on-premises component is required — just a valid API key with the correct permissions attached to your Meraki administrator account.
Security note: Your API key is encrypted with AES-256-CBC before storage. QuuPass platform administrators cannot read your plaintext key. The key is only decrypted in-memory at the moment an API call is made.
Before generating an API key, you must enable Dashboard API access at the organisation level. This is a one-time setting:
An API key inherits the permissions of the Meraki administrator account it belongs to. The table below lists every API operation QuuPass performs and the minimum permission level required.
| API Endpoint | Purpose | Access Required |
|---|---|---|
| GET /organizations | List organisations your key can access | Read |
| GET /organizations/:id/networks | List networks within an organisation | Read |
| GET /networks/:id/wireless/ssids | List SSIDs on a network | Read |
| PUT /networks/:id/wireless/ssids/:num | Configure SSID auth mode and RADIUS settings (Mode B setup) | Read + Write |
| GET /networks/:id/groupPolicies | Fetch group policies to attach to credentials | Read |
| POST /networks/:id/wireless/ssids/:num/identityPsks | Create a new IPSK identity when a credential is issued (Mode A) | Read + Write |
| GET /networks/:id/wireless/ssids/:num/identityPsks | List existing IPSK identities (credential sync, Mode A) | Read |
| DELETE /networks/:id/wireless/ssids/:num/identityPsks/:id | Remove expired or revoked credentials (Mode A) | Read + Write |
Meraki administrator roles are scoped per organisation and per network. For QuuPass we recommend creating a dedicated service account rather than using a personal admin account, so the API key is not affected if a staff member leaves.
Set to Read-only at the organisation level. QuuPass only needs to list organisations and networks — it never modifies organisation-level settings.
Set to Full access on the specific network(s) used for guest Wi-Fi. Restrict access to other networks as a security best practice.
Least-privilege principle: If you only use Mode B (RADIUS), QuuPass does not need write access to identity PSKs. You can safely remove the POST and DELETE permissions for/identityPsks endpoints from the service account.
The Meraki Dashboard API enforces rate limits. QuuPass is designed to stay well within them during normal operation, but it is useful to be aware of the constraints:
| Default rate limit | 10 requests per second per organisation |
| HTTP 429 response | Returned when the limit is exceeded. QuuPass handles these with automatic backoff and retry. |
| Retry-After header | Meraki includes this header in 429 responses. QuuPass respects it before retrying. |