Run a neighborhood Wi-Fi ISP long enough and you'll run into three letters constantly: RADIUS. It sits at the center of how networks decide who gets online — and it is also the reason hotspot billing and subscription Wi-Fi can work automatically. This guide explains how the pieces fit together.
What RADIUS actually does
RADIUS (Remote Authentication Dial-In User Service) is the protocol that lets an edge device ask a central server whether a user should be authenticated to the network. In a Wi-Fi ISP setup, the captive portal and edge router hand the authentication request to a RADIUS server, which answers with allow or deny — and reports when the session ends.
That single decision point is powerful: it means access rules, quotas, expiries and paywalls can all be managed centrally instead of on every router.
How captive portal and RADIUS combine
When a guest connects, the router redirects their browser to the captive portal. The portal authenticates the customer, checks the subscription record, and asks the edge device to authorise the device using RADIUS. On WPA/WPA2-Enterprise networks, the Wi-Fi login itself carries the RADIUS exchange.
In Authnet deployments, routers are onboarded as NAS devices: security is set to WPA/WPA2-Enterprise, the RADIUS server points at api.authnetworks.com with the port and secret shown in the dashboard, and every edge device speaks to one central access policy.
Hotspot billing built on authentication
Thermo key to hotspot billing is having one record of truth: what was purchased, when it activates, when it expires, and how many devices it covers. With RADIUS-managed access, that record feeds directly into enforcement.
- Purchase: a customer buys a plan or redeems a voucher through the portal
- Activation: the subscription becomes valid and the device is authorised
- Enforcement: quota, session time, expiry and device limits are checked at the edge
- Expiry: the network blocks access automatically when the subscription runs out
Subscription Wi-Fi: time-based and volume-based plans
Subscription Wi-Fi generalises vouchers into reusable packages. Plans can be time-controlled (a number of hours or days) or volume-controlled (a data quota), with configurable validity, expiry after activation, and maximum simultaneous devices. Customers buy through the portal and renew as needed.
For operators, subscriptions and vouchers together remove the two most manual jobs: issuing access one by one and enforcing rules by logging into routers. Everything flows from the central policy to the edge.
A practical checklist for ISPs
- Standardise router settings: WPA/WPA2-Enterprise, RADIUS address, port and secret
- Define plan rules centrally: quota, time, expiry and device limits
- Make payment-to-activation automatic, with temporary access for checkout
- Track revenue and payouts per business and coverage area
- Watch live device telemetry to catch connectivity issues early
The goal of a Wi-Fi ISP is leverage: one network, many customers, low-touch operations. RADIUS-managed access and automated hotspot billing are how that leverage becomes real.