Secure plug and play configuration of wireless distribution system (WDS) Wi-Fi range extenders

A cloud-based onboarding server detects a network change and facilitates an onboarding process for a new access point. An SSID and authentication credentials for an existing Wi-Fi channel are sent over a temporary Wi-Fi channel using a preconfigured SSID and passphrase generated by both the new access point and the master access point. A wireless station scans the identification information from a label on the new access point and sends it directly or indirectly to the master access point, so that both sides have the same seed for generating a matching passphrase. The master access point terminates the temporary channel and reactivates the existing Wi-Fi channel.