How to connect a MikroTik router to M-Pesa (Daraja STK Push)

If you are still confirming payments from your SMS inbox and flipping customers on by hand, this guide is for you. With M-Pesa STK Push wired to your own Daraja credentials, a customer pays and the system does the rest — confirms the transaction, activates their session on the MikroTik, and sends the receipt. No commission, no middleman, no you at 2 a.m.

How the pieces fit together

Three parts have to talk to each other: your MikroTik (which controls who gets online), a RADIUS/billing layer (which decides who is paid up), and Safaricom Daraja (which moves the money). STK Push is the flow that ties them together — you push a payment prompt to the customer's phone, they enter their PIN, and Safaricom calls a URL of yours to confirm it went through. That confirmation is what flips the customer online.

What you'll need

• A Safaricom Daraja developer account (free at developer.safaricom.co.ke)
• Your Paybill or Till (Buy Goods) number and its Lipa na M-Pesa passkey
• A MikroTik running RouterOS with API access enabled
• Admin access to your VillageHub panel (or your billing layer of choice)

1. Create your Daraja app

Log in to the Safaricom Daraja portal and create a new app with the Lipa na M-Pesa Online product enabled. Copy the Consumer Key and Consumer Secret — these authenticate your requests. Keep them somewhere safe; treat them like passwords.

2. Get your shortcode and passkey

You need your business shortcode (your Paybill, or your Till number for Buy Goods) and the online passkey that Safaricom issues for it. If you are testing first, Daraja's sandbox gives you a test shortcode and passkey so you can dry-run the whole flow before a single real shilling moves.

3. Add your credentials to your billing layer

Open Settings → Payments → M-Pesa in your VillageHub panel and paste the Consumer Key, Consumer Secret, shortcode and passkey. Because this is a bring-your-own-keys setup, funds settle straight from Safaricom into your own account — the platform never touches the money and charges no transaction fee.

4. Set your callback (validation & confirmation) URL

This is the step people get wrong. Safaricom needs a public HTTPS URL to call when a payment completes. VillageHub generates a secure callback URL for you; register it in Daraja so confirmations flow back automatically. The moment a customer completes an STK prompt, that callback fires, the payment is matched to their account, and their package activates on the router.

5. Connect the MikroTik

Add your router by IP with its API credentials — no firmware flashing, no site visit. From then on the billing layer speaks to RouterOS directly: it creates the hotspot user, applies the speed and data profile you sold, and removes access again when the plan expires. RADIUS handles the authentication so the router always knows who is currently paid up.

6. Test with a live shilling

Trigger a test purchase from your captive portal, approve the prompt on your phone, and watch the session go live in seconds. Confirm three things: the STK prompt reached the phone, the callback marked the payment as complete, and the router actually let the device online.

Troubleshooting the usual suspects

• Prompt never arrives: almost always wrong Consumer Key/Secret or a shortcode/passkey mismatch. Re-check them against Daraja.
• Payment succeeds but nothing activates: the callback URL is unreachable or unregistered. Confirm it is public HTTPS and pasted into Daraja exactly.
• Activates but no internet: the MikroTik API details or the RADIUS profile are off — check the router credentials and the speed/data profile mapping.

Once these three green-light, your billing runs itself day and night. Next up: package your plans to sell faster — read our guide on time & data vouchers.