What if WiFi password isn't provided on the Pi initially

[maxpavlov]

Hello.

I need to implement the following flow:

1. A Pi is started with a preconfigured open AP and the software that is able to manage Pi's configuration.
2. A user connected to an AP. AP pops up the captive portal interface with a list of WiFi Networks that the Pi "is able to see".
3. A user picks his own home wifi network (SSID) from the list and provides a password.
4. An AP's local webserver (that serves the captive portal UI) checks if it is able to connect it confirms this in the user.
5. Within the same interface, UI notifies the user if the connected WiFi network has internet access available.

Beyond that, I am fine to down the AP. But I need the AP to stay up uninterrupted till WPA supplicant can confirm the credential provided is valid and that it can connect to the internet with the wifi creds it has got.

I know there is a limitation of the connected WiFi and the AP to be on the same channel. This kind of makes the above-described flow impossible to achieve with one single wireless device, right? Hope there is a creative way to achieve this. I'd appreciate any comments. Thanks.