How enrollment and fallback work

CP Word List runs at two moments in a Cloudpath enrollment: an invisible notification that changes the DPSK, and the display page the user sees. This page explains what happens in each case, and why the service can never stop someone from getting online.

First enrollment

When a user enrolls for the first time:

1. Cloudpath generates the DPSK — a random string like x8kP2mQ9.
2. The notification fires. Cloudpath calls /api/change-dpsk?enrollmentId=${GUID}&secret=.... CP Word List authenticates to your Cloudpath server, looks up the DPSK for that enrollment, generates a memorable phrase like apple-red-truck, and updates the DPSK on the controller.
3. The mapping is cached for 5 minutes — the old random string mapped to the new phrase.
4. The display page loads. Its snippet takes the old DPSK from Cloudpath’s ${DPSK} variable and calls /api/get-dpsk to fetch the new phrase, then shows it and the SSID to connect to.

The user reads apple-red-truck off the screen and connects.

Re-enrollment

When a returning user re-enrolls, their DPSK is often already in word-list format. CP Word List handles this gracefully:

• The notification step still fires, but the passphrase change is skipped — the API returns 409 (a device is already connected) or 404 (no DPSK found for this enrollment). Either way it’s invisible to the user.
• The display snippet detects that the DPSK is already in word-word-word format and shows it immediately, with no API call.

That means CP Word List is not a dependency for returning users viewing their existing passphrase.

The 5-minute cache

The old-to-new passphrase mapping is cached for 5 minutes so the display page can look it up. The display page polls during this window. After 5 minutes the mapping expires — but the new passphrase is already set on the controller and stays active indefinitely. Expired mappings are purged automatically.

Downtime never blocks network access

CP Word List is an enhancement layer. It cannot prevent anyone from connecting, because the DPSK Cloudpath generated is always valid. If the service is unreachable or erroring:

• The display snippet waits up to 15 seconds (polling up to 7 times), then falls back to showing the original Cloudpath passphrase — a working, valid credential.
• For returning users whose DPSK is already word-based, no API call is made at all — the passphrase shows instantly.

The only effect of an outage is that a new enrollment sees a random passphrase instead of a memorable one. Network connectivity is never affected.

For the underlying endpoints and Cloudpath REST API calls, see the API reference.