How to Set Up M-Pesa for Wi-Fi Hotspot Billing in Kenya

If you run a Wi-Fi hotspot in Kenya, M-Pesa is not optional — it is how the vast majority of your customers will pay. The question is not whether to accept M-Pesa, but how to connect it to your network so that payment and internet access happen automatically, without you manually checking a phone for confirmation messages every time someone buys a bundle.

Till Number vs Paybill: which one do you need?

You need your own Safaricom business number — either a Till Number (Buy Goods) or a Paybill Number. A hotspot billing platform cannot process payments on your behalf without one; customer payments go straight to your own number, and a well-built platform never takes a cut of that transaction or sits in the middle of the money.

Registering on the Daraja API developer portal

Once you have a Till or Paybill number, the next step is registering an app on Safaricom's Daraja API developer portal. This is what generates the API credentials (consumer key, consumer secret, and passkey) that let software initiate STK Push prompts on your customers' phones — the "Enter M-Pesa PIN" prompt they see the moment they select a package.

These credentials are sensitive — treat them like a password. A properly built billing platform encrypts them (AES-256 is the standard to look for) before storing them, so that even someone with database access can't read your live Daraja secrets in plaintext.

What happens after a customer pays

With STK Push wired up correctly, the flow looks like this:

• Customer selects a data package on your captive portal or portal page
• They receive an M-Pesa prompt on their phone and enter their PIN
• Safaricom sends a payment confirmation callback to your billing system
• The system creates or extends their session on your Mikrotik router automatically
• The customer receives their login credentials or is connected instantly — no manual step from you

Plan for M-Pesa downtime

Safaricom's Daraja platform occasionally has downtime, and during that window new STK Push payments simply cannot go through. Two things matter here: existing active sessions should continue uninterrupted (a payment outage should never disconnect someone who already paid), and you should have a fallback — pre-generated voucher codes that customers can redeem without a live payment step, so a short M-Pesa outage doesn't mean turning away walk-in customers.

Get the Till/Paybill and Daraja registration right first — everything else in automated hotspot billing (session control, SMS delivery, reporting) builds on top of that single connection.