How would you secure a for-pay wifi router to prevent others from gaining free access?
There is context missing here, but I will try to make reasonable guesses.
For who?
This is the most important question. If your target audience is compulsivly honest and unerringly punctual in payment then most other questions are of little concern. However, a more realistic answer would include a significant percentage of users willing to cheat or steal. Then who need to estimate their computer abilites to determine their ability to cheat the system given the opportunity.
Where?
Let's arbitrarly choose Vancouver in the downtown area. This will attract a variety of users from vacationers to business people. Certainly a area with a high flow rate of people can produce bursts of high demand and reliable dead times.
How much?
This is critical to your question. When the cost goes above what some users consider a fair amount, some percentage of users will attempt to steal service. They might attempt to pay for some service and use more than they are entitled to or they may attempt to recieve service without paying. The higher the cost the better your proffit but the more users will attempt to steal service. Unfortunatly it is difficult to tell what most users consider fair and what they consider fair may be below the cost of providing service (meaning negative profit). Still if it is feasible I would recommend a simple survey of what likely users would be willing to pay.
Fee basis.
How will you charge users for WiFi service? My best guess is flat daily rate with a price breaks at three days, five days, weekly, and monthly.
Identification
This is tricky. I would prefer in-person initial transaction, but given the nature of the business this seems impractical. I think I would allow remote registration and payment over a SSL connection. Then generate or register a public key and link payment to the public key.
Authentication
OAuth Its already implemented and in significant use. An alternative would be Microsoft PKI using Windows Server 2008, but it may be more difficult to authenticate users with Linux, Android, Mac OS X, etc.