Hotspot Self-Service: OTP, Payment & Auto-Suspension
How ISPbills automates hotspot customer self-registration, OTP verification, online payment, RADIUS activation, and auto-suspension — with no staff intervention.
On this page
ISPbills turns your MikroTik Hotspot into a fully automated WiFi zone. A customer connects to your SSID, is redirected to the ISPbills captive portal, verifies their mobile number with a 4-digit OTP, selects a package, pays online, and goes live instantly. When their time or data runs out, ISPbills suspends the account automatically.
How It Works — End-to-End Flow
Customer connects to WiFi SSID
↓
MikroTik redirects browser to ISPbills captive portal
↓
ISPbills verifies the mobile number and MAC address
↓
New customer → 4-digit OTP sent via SMS (valid 5 min)
↓
OTP verified → trial package assigned → RADIUS user created → internet activated
↓
Customer selects package → pays via bKash / Nagad / Shurjopay / etc.
↓
ISPbills confirms payment → updates RADIUS attributes → activates session via RouterOS API
↓
Session expires or data limit reached → auto-suspended → SMS notification sent
↓
Customer revisits portal → purchases new package → reactivated instantly
Prerequisites
Before enabling self-service hotspot:
- The MikroTik router must be registered in ISPbills with working API credentials.
- At least one Hotspot package must be created with Customer Type = Hotspot.
- At least one SMS gateway must be configured in Settings → SMS Gateway for OTP delivery.
- At least one payment gateway must be configured in Settings → Payment Gateways.
- The Walled Garden must be pushed to the router so unauthenticated customers can reach the payment gateway.
OTP Verification
When a new customer connects for the first time, ISPbills sends a 4-digit OTP to their mobile number through the configured SMS gateway.
| Property | Value |
|---|---|
| OTP length | 4 digits |
| Validity | 5 minutes |
| Delivery channel | SMS only (WhatsApp is intentionally disabled for hotspot OTP) |
| Retry | Customer can request a new OTP by revisiting the verification page |
After OTP is verified:
- ISPbills activates the customer with the Trial package.
- Internet access is enabled on the MikroTik router.
- A welcome SMS is sent to the customer.
The Trial package gives new customers a few minutes of free internet while they browse your available plans. Create a package named Trial with a short validity (e.g. 5 minutes, zero price) to enable this feature.
Supported Payment Gateways
ISPbills supports the following payment gateways for hotspot customer self-payment:
| Gateway | Region | Notes |
|---|---|---|
| bKash Tokenized Checkout | Bangladesh | Recommended — no redirect required |
| bKash Checkout | Bangladesh | Classic checkout flow |
| Nagad | Bangladesh | Instant payment |
| Shurjopay | Bangladesh | Multi-bank support |
| SSLCommerz | Bangladesh | Card + mobile banking |
| Razorpay | India | Card, UPI, netbanking |
| Stripe | Global | Card payments |
| M-Pesa | Kenya / Africa | STK push |
| JazzCash | Pakistan | |
| Easypaisa | Pakistan | |
| eSewa | Nepal | |
| Khalti | Nepal | |
| IME Pay | Nepal | |
| PayPal | Global | |
| HBL Konnect | Pakistan | |
| Instamojo | India |
The Walled Garden push in ISPbills automatically configures Layer7 firewall rules for every enabled payment gateway. See Walled Garden for details.
RADIUS Session Settings
ISPbills manages the following authentication and session settings for hotspot customers.
Authentication rules
| Attribute | Value | Purpose |
|---|---|---|
Cleartext-Password |
Device MAC address | RADIUS password — matches mac-as-username-and-password mode on MikroTik |
Expiration |
e.g. 07 Jun 2026 23:59:59 |
Hard time cutoff — FreeRADIUS rejects login after this timestamp |
Session policy
| Attribute | Example Value | Purpose |
|---|---|---|
Mikrotik-Rate-Limit |
"10M/5M" |
Download / upload bandwidth cap enforced by RouterOS |
Mikrotik-Total-Limit |
2147483648 |
Total bytes (upload + download) allowed — 0 for unlimited |
For unlimited data packages, Mikrotik-Total-Limit is set to 0. Session enforcement is then purely time-based via the Expiration attribute.
RADIUS attributes are updated automatically whenever a customer purchases a new package — the new expiry and limits are written in real time, and the MikroTik session is refreshed via the RouterOS API.
Session Activation
After OTP verification or payment confirmation, ISPbills activates the customer’s session automatically. When a customer is suspended or logs out from the portal, the active hotspot session ends.
The RouterOS API credentials must be correct in the router settings. Verify them in Routers & Packages → Routers → Edit if session activation fails.
Returning Customers — MAC Re-Authentication
ISPbills stores the device MAC address as the RADIUS username. On subsequent visits:
- Active package — ISPbills returns
Access-Acceptwith fresh RADIUS attributes. The RouterOS API login call fires automatically — the customer goes online without entering anything. - Expired / suspended — ISPbills returns
Access-Reject. MikroTik redirects the customer to the portal to purchase a new package. - New device, same mobile number — ISPbills detects the MAC change and initiates a MAC replacement flow so the customer can link their new device to their existing account.
Multi-AP deployments: All access points in the same hotspot zone must broadcast the same SSID. ISPbills identifies customers by MAC address — a different SSID is treated as a different network and MAC re-auth fails.
Auto-Suspension
ISPbills checks hotspot customers against their package limits. Two conditions trigger suspension:
Data limit exceeded
When the customer’s total upload and download usage reaches the package limit, ISPbills suspends the account and records the event.
Time limit exceeded
When the package expires in the operator’s timezone, ISPbills suspends the account and records the event.
What happens to the customer
On the customer’s next connection attempt, ISPbills sends an SMS notifying them that their balance is low (sent once per suspension cycle). The customer is redirected to the portal to purchase a new package.
RouterOS also enforces the configured time and data limits at the network level.
Suspension events are viewable in the ISPbills dashboard under Logs → Hotspot.
Operator Recharge from Dashboard
Operators can manually recharge or change a hotspot customer’s package from the dashboard — for cash walk-in customers or support scenarios.
- Navigate to Customers and find the customer.
- Use Actions → Hotspot Recharge or Actions → Change Package.
- ISPbills shows available hotspot packages with a real-time invoice preview.
- After confirming, ISPbills:
- Records the payment as Cash
- Updates the customer’s RADIUS attributes
- Activates the session via the RouterOS API immediately
- Records the recharge in the activity history
A PDF voucher/receipt is generated for every payment (self-service or operator-assisted). Download it from Accounts → Customer Payments → Download Voucher.
Hotspot Logs
View hotspot events in the dashboard under Logs → Hotspot.
| Action | Description |
|---|---|
registration_attempt |
A new customer started the OTP flow |
login |
A returning customer was successfully authenticated |
mac_replace_attempt |
Customer tried to connect from a new device |
recharge |
Operator manually recharged the customer |
Troubleshooting
Customer stuck on captive portal after payment
Verify the MikroTik API credentials in Routers & Packages → Routers → Edit. ISPbills must be able to connect to the router on port 8728. Check Logs → Hotspot for login errors.
Payment page is blank or won’t load
The Walled Garden is missing or incomplete. Run Push to Router again from Routers → Actions → Walled Garden. Re-run whenever you enable a new payment gateway.
OTP not received
Check Logs → SMS History in ISPbills. Verify the SMS gateway has sufficient balance and the correct credentials in Settings → SMS Gateway.
Customer not suspended after data limit is reached
Confirm radius-interim-update is set in the MikroTik hotspot profile (e.g. 2m). Without accounting updates, ISPbills cannot track consumption against the Mikrotik-Total-Limit.
MAC re-authentication not working
All access points in the zone must use the same SSID. Check this in MikroTik under Wireless → Interfaces and confirm the SSID is identical on every AP.