What is OwnPay?

OwnPay is an open-source payment gateway you host yourself, giving developers and businesses full control over payment infrastructure. It supports over 120 payment gateway integrations through a plugin system, multi-brand management with isolated domains and ledgers, white-label checkout on custom domains, a double-entry ledger engine for audit-ready accounting, and a sandboxed plugin architecture. The platform runs on PHP 8.3+ with MySQL or MariaDB, deployable on shared hosting, VPS, or dedicated servers via a release archive that bundles all dependencies. It includes a REST API with webhooks, mobile companion app support with JWT authentication, and granular staff RBAC. Currently in public beta (v0.2.0) with AGPL-3.0 licensing.

Should you self-host OwnPay?

OwnPay scores 46/100 on selfhost.directory (how scoring works) and ranks #6 of 10 in E-commerce. It has 210 GitHub stars.

It shipped 4 stable releases in the past year. The latest, v0.2.0, came out on 7 July 2026. New versions land roughly every 4 days.

Setup is moderate: expect some configuration beyond a single command. It is AGPL-3.0-licensed and written mostly in PHP.

Its closest alternative on selfhost.directory is BTCPay Server (76/100, 7 860 stars). It scores higher overall, so compare the two before you pick. See OwnPay vs BTCPay Server side by side.

Features

AES-256-GCM encryption
Double-entry ledger
Full i18n
Hosted checkout & payment links
Multi-brand management
Multi-currency Support
Multi-gateway payment processing
Plugin/hook system
Rate limiting & security headers
Refunds with atomic reversals
REST API with webhooks
Self-update engine
Staff RBAC
White-label checkout

How to configure OwnPay

APP_DEBUGfalse
APP_DOMAINyourdomain.com
APP_ENVproduction
APP_KEY
APP_NAMEOwnPay-- Application -----------------------------------------------------------------
-- Application -----------------------------------------------------------------
APP_TIMEZONEAsia/Dhaka
APP_URLhttps://yourdomain.com
AUDIT_HMAC_SECRET
CACHE_DRIVERfile-- Cache & Queue --------------------------------------------------------------- Driver options: 'file' (shared hosting) | 'redis' (VPS/cloud)
-- Cache & Queue --------------------------------------------------------------- Driver options: 'file' (shared hosting) | 'redis' (VPS/cloud)
CORS_ALLOWED_ORIGINS-- CORS ------------------------------------------------------------------------
-- CORS ------------------------------------------------------------------------
DB_CHARSETutf8mb4
DB_COLLATIONutf8mb4_unicode_ci
DB_HOST127.0.0.1-- Database --------------------------------------------------------------------
-- Database --------------------------------------------------------------------
DB_NAMEownpay
DB_PASS
DB_PORT3306
DB_PREFIXop_
DB_USERroot
ENCRYPTION_KEY-- Security --------------------------------------------------------------------
-- Security --------------------------------------------------------------------
GATEWAY_CALLBACK_URLIf APP_URL is a local dev domain (e.g. https://ownpay.test) that external gateways (bKash, SSLCommerz, Stripe) cannot reach, set this to a public URL (e.g. an ngrok tunnel) so gateway callbacks/redirects work during development. Leave blank in production - APP_URL is used instead.
If APP_URL is a local dev domain (e.g. https://ownpay.test) that external gateways (bKash, SSLCommerz, Stripe) cannot reach, set this to a public URL (e.g. an ngrok tunnel) so gateway callbacks/redirects work during development. Leave blank in production - APP_URL is used instead.
HMAC_KEYset to 16+ random chars, send as X-Install-Force-Key header, remove after.
set to 16+ random chars, send as X-Install-Force-Key header, remove after.
INSTALL_FORCE_KEY
JWT_SECRET-- JWT (Mobile API) ------------------------------------------------------------
-- JWT (Mobile API) ------------------------------------------------------------
QUEUE_DRIVERfile
REDIS_HOST127.0.0.1-- Redis (only required if CACHE_DRIVER=redis or QUEUE_DRIVER=redis) ----------
-- Redis (only required if CACHE_DRIVER=redis or QUEUE_DRIVER=redis) ----------
REDIS_PORT6379
REDIS_PREFIXop:
TRUSTED_PROXIES-- Trusted Proxies -------------------------------------------------------------
-- Trusted Proxies -------------------------------------------------------------

FAQ

Do you accept sponsors and donations?

Yes — sponsorships fund infrastructure, developer time, and security tooling. Visit ownpay.org/donate or email ping@ownpay.org.

Can I run it on cheap shared hosting?

Yes. The release archive bundles all dependencies, so no SSH or Composer is needed on the server — upload, point your domain at public/, and run the installer. You just need PHP 8.3+ and a MySQL/MariaDB database.

What does "Public Beta" mean for production use?

It's stable and usable today. For production, pin to a tagged release, test in staging first, keep backups, and follow the hardening notes in the docs.