QuuPass connects to Meraki using Cisco's official OAuth 2.0 Authorization Code flow. You approve access directly in your Cisco dashboard — we never see your password or a long-lived API key. Access is scoped to exactly what QuuPass needs to do its job, and nothing more.
You click "Connect with Cisco Meraki"
QuuPass generates a signed, time-limited CSRF state token and redirects your browser to Cisco's authorization server at as.meraki.com.
You approve access in Cisco's dashboard
Cisco shows the list of scopes QuuPass is requesting. You approve (or deny) directly on Cisco's domain — QuuPass never touches this step.
Cisco sends an authorization code to QuuPass
Cisco redirects back to meraki.quupass.cloud/api/meraki/oauth/callback with a short-lived code. QuuPass validates the CSRF state cookie before proceeding.
QuuPass exchanges the code for tokens
A server-to-server call exchanges the code for an access token and refresh token. Both are AES-256-CBC encrypted before being written to the database. The plaintext tokens are never logged or persisted.
Access tokens are refreshed automatically
When an access token expires, QuuPass uses the encrypted refresh token to obtain a new one silently — no re-authorization needed until you revoke access.
QuuPass requests the minimum set of scopes required to manage guest IPSK credentials. Only one scope grants write access — provider-level configuration, billing, user management, and security settings are entirely outside our scope.
| Scope | Access | Why it's needed |
|---|---|---|
dashboard:general:config:read | Read | Fetch the list of organizations your account has access to so you can pick which one QuuPass manages. |
dashboard:general:telemetry:read | Read | Read organization-level telemetry data (used for health checks and status indicators). |
wireless:config:read | Read | List networks, SSIDs, and existing IPSK identities so QuuPass can display and manage guest credentials. |
wireless:config:write | Write | Create and delete IPSK guest identities (passphrases) on your SSIDs. This is the core function of QuuPass. |
wireless:telemetry:read | Read | Read connected-client data to show who is actively connected with a given credential. |
Access and refresh tokens are encrypted with AES-256-CBC using a key stored separately from the database. Tokens are never written in plaintext.
Token values are stripped from all application logs before being written. Log aggregation systems never receive raw token strings.
Cisco access tokens expire in under an hour. QuuPass uses the refresh token to rotate them automatically without user interaction.
You can revoke access at any time from your Cisco Meraki dashboard under OAuth Applications. This immediately invalidates all tokens.
After revoking, QuuPass will no longer be able to create or delete credentials. To reconnect, go to Account Settings → Meraki Connection and click Connect via Cisco OAuth.