Copy the generated script once. After check-in, the controller deploys the rest over API.

1. Set serial, RouterOS version, Wi-Fi names, and DHCP pools first. The script follows those fields.
2. Copy script and paste it into the MikroTik terminal once.
3. RouterOS 6 uses two blocks: the first sets identity, the API user, API-SSL, the firewall allow, and check-in; the second sets Wi-Fi, DHCP, RADIUS, hotspot, and the command poll. If the second block stops, the first still stays.
4. RouterOS 7 uses the wifi menu. After check-in the controller talks to the public IP from that report.
5. Initial deploy opens Deploy status. That window lists fetch, scheduler, and hotspot as On or Off, plus whether the controller has finished guest LAN. If a flag is Off, paste the command shown, press I pasted it, then unplug the power cable within 5 minutes. Do not use Reboot in Winbox.
6. On RouterOS 7, home routers such as the hAP ax S ship in device-mode home, which blocks hotspot, fetch, and scheduler. That can be changed: the deploy script runs one command, /system device-mode update mode=advanced. Leave the terminal on the countdown, then unplug the power cable or press the mode/reset button within 5 minutes. Do not use Reboot in Winbox, and do not paste a second device-mode update — a second update cancels the first. Quick Set may still say Home AP Dual; that wizard is unrelated, ignore it.
7. If a modem sits in front of the router, forward TCP 8729 (API-SSL) to the MikroTik. TCP 443, UDP 1812, and UDP 1813 are outbound from the router and do not need a forward. A green pill means the controller has confirmed that path.