docs

Wi-Fi offload

heliumOS Wi-Fi offload is a full Passpoint (Hotspot 2.0) service that moves your subscribers onto your own or Helium's Wi-Fi network with a single SDK install or a few REST calls. Each subscriber gets an EAP-TLS certificate signed by Helium's CA; devices present it to authenticate against Passpoint hotspots, and Helium's network handles the AAA side.

Wi-Fi offload runs on its own service, with its own partner record, API keys, environments, and base URLs, separate from your heliumOS platform keys and the platform API. Keys are not interchangeable between the two.

Pick an integration path

  • Mobile SDK
    Install @helium/passpoint-sdk in your React Native app. The SDK provisions and revokes per-subscriber EAP-TLS certificates against the OS keychain.
  • Server-to-server API
    Manage subscribers and revoke certificates from your backend. Use this when your app is native (non-React Native), or when you want centralized control.

Not sure which you want? Start with the SDK quickstart.

How it fits together

  1. You request an API key from Helium.
  2. Your app (or backend) calls the Wi-Fi offload gateway with that key.
  3. The gateway authenticates the key and routes to the inventory service.
  4. The inventory service mints an EAP-TLS certificate for the subscriber, signed by Helium's CA.
  5. Devices use that certificate to authenticate to Passpoint hotspots.

Endpoints at a glance

Every endpoint authenticates with the X-Helium-P-API-Key header. The API reference has full schemas and a try-it panel that applies your key to every request.

  • POST /preset/profile/generate/
    Issue a per-subscriber EAP-TLS certificate. The SDK calls this for you.
  • GET /preset/profile/status/
    Check active profile status for a subscriber.
  • PUT /partners/{partner_id}/users/{subscriber_id}/
    Enroll a subscriber from your backend.
  • GET /partners/{partner_id}/users/{subscriber_id}/
    Fetch subscriber metadata.
  • DELETE /partners/{partner_id}/users/{subscriber_id}/
    Revoke a subscriber.
  • POST /partners/{partner_id}/certificates/
    Rotate the certificate your access points present.
  • GET /partners/{partner_id}/certificates/
    Fetch the current access-point certificate.

Everything in this section

Get started

  • Prerequisites
    The partner record, API key, and mobile project setup you need first.
  • Quickstart
    Install, configure, and provision your first subscriber in five minutes.

Operations

  • API keys
    How keys are issued, the two roles, rotation, and compromise response.
  • Environments
    Production and development have separate keys, records, and CAs.
  • Rate limits & errors
    Status codes, retry strategy, and the error envelopes on both sides.

Mobile SDK

  • Install
    Package install plus the iOS entitlements and Android permissions.
  • Configure
    Every PasspointConfig option and what to pass at app startup.
  • Usage
    Installing, removing, and refreshing Passpoint profiles.
  • Subscriber IDs
    The join key between your subscriber records and the certificate registry.
  • Error catalog
    Every PasspointErrorCode, what fires it, and how to recover.
  • Troubleshooting
    The failures partners hit most, and what actually fixes them.

Revocation

  • Overview
    When to revoke server-side, and why SDK remove is not revocation.
  • Revocation API
    The DELETE call, its responses, and what revocation actually does.
  • Bulk revocation
    Revoking many subscribers safely while respecting rate limits.

Network & reference