WiFi Hotspot Billing in Kenya: How It Works (Wave Billing)

WiFi hotspot billing is the system a Kenyan internet provider uses to charge for access: a MikroTik router holds every new device at a captive portal, the customer pays by M-Pesa or types a voucher code, and a RADIUS server tells the router how fast and for how long that customer may browse. The same stack bills monthly PPPoE subscribers.

The way we recommend running it is Wave Billing, the MikroTik hotspot and PPPoE billing system we build at Quickwave Technologies in Nairobi, with M-Pesa collected through our gateway, ZetuPay. Wave Billing is in early access: WhatsApp us on 0798 871 229 to request a place.

How does WiFi hotspot billing work?

It has four parts:

• The MikroTik router. Its HotSpot gateway redirects every client to a login page until they authenticate (MikroTik HotSpot documentation).
• The RADIUS server. Often FreeRADIUS (freeradius.org). The router asks it whether each login is allowed on UDP port 1812 (RFC 2865) and reports usage on UDP port 1813 (RFC 2866).
• The billing system. It holds packages, customers, vouchers, payments and expiry dates, and decides what RADIUS answers.
• M-Pesa. The customer approves an STK Push prompt sent by a gateway such as ZetuPay (see our STK Push guide), or buys a printed voucher from an agent.

A sale, step by step:

1. The phone joins the open network and is redirected to the login page.
2. The customer picks a package, enters an M-Pesa number and approves the prompt with their PIN.
3. The payment gateway confirms the payment to the billing server, which issues a login code.
4. The portal logs the phone in. The router sends an Access-Request to RADIUS, which answers Access-Accept with the speed and time allowed.
5. The router reports usage while the session runs. When the time is up, the phone is back at the portal.

A voucher sale skips steps 2 and 3, because the agent paid for the batch.

How does Wave Billing run your hotspot?

Wave Billing is a WiFi hotspot and ISP billing system for Kenyan providers on MikroTik routers. It runs the billing, RADIUS and captive portal for hotspot, PPPoE and static customers from one account. Here is the same flow in Wave Billing:

1. Connect the router with one command. Add the MikroTik by name and paste the generated command into its terminal. The router registers itself, and Wave Billing reads its model, RouterOS version and interfaces.
2. Map the ports. Set each port to hotspot, PPPoE or both. Wave Billing configures the RADIUS client, IP pools, DNS, the hotspot and PPPoE servers and the portal redirect.
3. Create packages. Set a KES price, a duration and upload and download speeds in Mbps, with an optional fair usage cap in GB, a throttled speed and burst.
4. Sell on the captive portal. Customers choose Voucher or Buy WiFi. Buy WiFi lists the router’s plans in KES and takes an M-Pesa number; ZetuPay sends the prompt, and the portal checks the payment every 3 seconds, then issues a 6-character login code and connects the phone.
5. Print vouchers for agents. Generate a batch for any package and print it as voucher cards or export it to CSV. Each voucher records when it was used and by which device.
6. Let RADIUS enforce the package. The included FreeRADIUS checks account status, expiry, password and MAC binding, then sets the speed limit and a session timeout that ends at expiry.
7. Watch live sessions. The Active Sessions page lists connections with upload and download totals, and you can disconnect one or several on the router.
8. Cut off and remind automatically. Every 30 seconds, expired accounts are marked, their PPPoE secret is disabled, the session is dropped and a notice goes out by WhatsApp or by SMS through Africa’s Talking, JulySMS or BlessedText.
9. Let subscribers renew themselves. PPPoE customers see their package, days left, data used and invoices in the customer portal, and renew by M-Pesa. Paying early adds the days to the current expiry.
10. Run agents and the books. Resellers get their own console to register subscribers, up to a limit you set. The finance pages show renewals due in 7 days, overdue accounts, invoices, expenses and net profit.

On payments, each provider adds its own ZetuPay keys, and ZetuPay settles every payment straight to that provider’s paybill, till or bank account; it never holds your sales. Wave Billing verifies each payment callback’s signature and activates each payment only once.

Wave Billing is in early access. Request early access on WhatsApp (0798 871 229) and tell us your router count. Need M-Pesa collection today? ZetuPay is live.

What does RADIUS control in a billing system?

RADIUS turns a package into rules the router enforces. MikroTik’s RADIUS documentation lists the reply attributes that matter:

• Mikrotik-Rate-Limit sets the speed, with optional burst. It is written from the router’s side, so 5M/10M means 5 Mbps up and 10 Mbps down for the client.
• Session-Timeout sets the maximum seconds a session may last. Wave Billing sets it to the seconds left until expiry, so the router cuts the session on time even if the billing server is unreachable.
• Acct-Interim-Interval sets how often the router reports usage, which is what a fair usage limit is counted from.

What is the difference between hotspot and PPPoE billing?

Hotspot billing sells short, prepaid access to walk-in users through a web login. PPPoE billing sells monthly plans to subscribers whose router dials in with a username and password. One MikroTik can serve both on different ports, and Wave Billing bills both from one account.

Question	Hotspot	PPPoE
Who it suits	Walk-in users in estates, shops, hostels and cafés	Homes and businesses on fibre or fixed wireless
How the user logs in	Captive portal: voucher or M-Pesa purchase	PPPoE client on the customer’s router, set once
Typical package	Hours or days, prepaid	30 days, renewed monthly
How customers pay	STK Push on the portal, or a printed voucher	STK Push from a customer portal
What identifies the user	Login code, plus the device’s MAC address	PPPoE username and password

MikroTik hotspot user profiles allow one device per username at a time by default (shared-users is 1), which stops one voucher being used on five phones. For PPPoE, keep the MTU at or below 1492, the maximum in MikroTik’s PPPoE documentation.

How do FUP, expiry and suspension work?

A fair usage policy (FUP) caps the data on a package: past the cap, the customer drops to a slower speed instead of being cut off. In Wave Billing you set the cap and throttled speed per package and follow usage on the FUP Monitor page. If you build your own, count the Acct-Input-Gigawords and Acct-Output-Gigawords attributes too, because the 32-bit octet counters wrap past 4 GB.

Expiry needs a second guard, because RADIUS only decides at login: that is Wave Billing’s 30-second suspension check. One trap: RouterOS only asks RADIUS when no local PPP secret matches (MikroTik PPP AAA), so a forgotten local secret can keep an expired subscriber online.

How much does a WiFi billing system cost in Kenya?

Wave Billing is in early access, with no published price yet: we quote each provider on WhatsApp. M-Pesa collection through ZetuPay has no percentage fee and no setup fee: you pay a flat fee per successful payment with prepaid service tokens, or a monthly, quarterly or annual plan with unlimited payments (ZetuPay pricing). Tokens suit a new hotspot; once you sell many small bundles a day, an unlimited plan fixes the cost.

For comparison, here are four other platforms’ published prices as of October 2026, and what each would cost a hotspot selling KES 30,000 or KES 100,000 a month.

Platform	Published pricing	At KES 30,000 a month	At KES 100,000 a month
Hotspot Kenya	Free below KES 3,500 monthly sales; KES 500 a month below KES 8,000; KES 1,500 a month above	KES 1,500	KES 1,500
Mobilink	KES 1,500, 2,500 or 3,500 a month by plan, plus 3% of the previous month’s income	KES 2,400 (Starter)	KES 4,500 (Starter)
KAMWIFI	No monthly fee; 15% of the first KES 3,333.33 of monthly hotspot sales, then 5%; payout charges extra	About KES 1,833	About KES 5,333
Ikonnect	2.5% per hotspot sale; KES 20 per active PPPoE client a month, or KES 10,000 flat; KES 1,500 one-time onboarding	KES 750	KES 2,500

The cost columns are our arithmetic, assuming steady sales and leaving out onboarding, SMS and payout charges; plans also differ in limits (Mobilink’s Starter covers 2 routers and 2,000 users). At 2.5%, the break-even with a KES 1,500 flat fee is KES 60,000 a month. Ask every provider whether payments land in your own paybill or till, or in their account first. With ZetuPay, they land in yours.

Can you build hotspot billing yourself instead?

Yes, if you have the time: FreeRADIUS is free (MikroTik’s User Manager is another option), but you carry the server, security and M-Pesa work. In short (check each step against MikroTik’s manual):

1. Add each router as a FreeRADIUS client with a strong shared secret, and accept UDP 1812 and 1813 only from your routers.
2. Add the server under /radius, turn on use-radius and radius-accounting in the hotspot server profile, and enable use-radius under /ppp aaa.
3. Edit the hotspot’s login.html and add walled-garden entries for your payment pages, so customers can pay before they log in.
4. Connect M-Pesa through ZetuPay, verify every callback, and activate each payment once.
5. Pay KES 10 from your own phone and check the speed, the usage records and that the session ends at expiry. ZetuPay has no sandbox, so test and live keys both move real money: test with small amounts.

Wave Billing includes FreeRADIUS and, once you map the ports, sets up the RADIUS client, hotspot server and portal redirect for you. For a fully custom system, see our custom software development and M-Pesa integration services.

Why do customers get logged out when you rename the network?

Because phones default to a different MAC address for each network, so the router no longer recognises them. Android 10 and later randomises the MAC per network profile, including the SSID (Android documentation). iPhones on iOS 14 and later use a private address per network, and from iOS 18 open networks default to Rotating, which changes it every two weeks (Apple Support). Treat MAC-based auto-login as a convenience, and always give customers a code they can type again.

Do you need a licence to run a WiFi hotspot business in Kenya?

Yes, if you sell internet access to the public. The Communications Authority of Kenya (CA) licenses providers under a unified framework whose current market structure dates from April 2026. These categories fit most hotspot and small ISP businesses, as of October 2026, per CA’s Revised Telecommunications Market Structure (June 2026):

Licence	What it covers	Initial licence fee	Annual operating fee
Applications Service Provider (ASP)	Services to end users, including internet, over infrastructure leased from a Network Facilities Provider	KES 100,000 (15-year term)	0.4% of annual gross turnover or KES 80,000, whichever is higher
Micro Network and Service Provider (MNSP)	Your own infrastructure and services within one county	KES 25,000 (15-year term)	0.4% of annual gross turnover or KES 25,000, whichever is higher
Network Facilities Provider Tier 3 (NFP-T3)	Your own infrastructure in up to three counties	KES 200,000 (15-year term)	0.4% of annual gross turnover or KES 160,000, whichever is higher

Application fees are KES 5,000 for ASP and NFP-T3 and KES 2,000 for MNSP. CA publishes each endorsed application in the Kenya Gazette for at least 30 days before deciding (CA licensing procedures), so start early. MNSP is a new category, so confirm with CA that it is open for applications. Telecommunications service providers must also register with the Office of the Data Protection Commissioner whatever their turnover (Data Protection Registration Regulations, 2021, Third Schedule). This is a summary, not legal advice.