Prepare the router, register it in WiFi Sphere, paste the script, then wait until check-in and deploy succeed.

1. Give the MikroTik internet on the WAN port (usually ether1). A DHCP client on WAN is enough. Do not use the guest LAN for this.
2. Note the serial from the sticker or System → Routerboard, and whether the router runs RouterOS 6 or 7. You will type both into WiFi Sphere.
3. In Winbox or WebFig, sign in as admin. Leave the default admin account in place. WiFi Sphere creates its own API user and never logs in as another network’s user.
4. In the controller, open Networks → Create Network. Enter the name, that serial, RouterOS 6 or 7, the first Wi-Fi name, and the DHCP pool for guests. Create network. Pay for an extra slot if this is not the company’s included MikroTik.
5. Open the new network page. Copy the MikroTik config. On the router, open New Terminal and paste the script once, then wait until it finishes.
6. The script sets the identity to the serial, creates a unique API user, signs an API-SSL certificate, opens TCP 8729 from the controller only, posts the first check-in, and starts the one-minute check-in. RouterOS 6 uses two blocks; if the second stops, the first still stays.
7. Back on the network page, Check-in should go Online after a report in the last 10 minutes. Initial deploy then runs over API: guest LAN, RADIUS, hotspot, and Wi-Fi. Wait until it says Deployed. The Waiting line shows the last API error while it retries.
8. If a modem or firewall sits in front of the MikroTik, forward TCP 8729 (API-SSL) to the router. The paste script already allows the controller on the MikroTik input filter. Check-in can work without a forward; the controller cannot finish deploy until that port is reachable on the public IP. TCP 443, UDP 1812, and UDP 1813 are outbound from the router and do not need a forward.
9. When Deployed is green, the SSID should broadcast. Design the splash page next so guests can sign in. If Wi-Fi is quiet, confirm the radio is enabled and Update Wi-Fi has been taken.