A wireless local area network (WLAN) system includes a multi-access point (multi-AP) controller configured to onboard, authenticate, and configure respective basic service sets (BSSs) of access points in a multi-AP network. A plurality of access points (APs), including at least a first AP and a second AP, communicate with the multi-AP controller over a backhaul network, and in response to instructions conveyed by the multi-AP controller over the backhaul network, associate and communicate with client stations (STAs) over wireless fronthaul links in the WLAN system using the respective BSSs configured by the multi-AP controller. The first AP and the second AP are configured to request and receive at least one cryptographic value from the multi-AP controller, and to apply the at least one cryptographic value in securing a message transmitted over the backhaul network from the first AP to the second AP.