Plugin System - Extensible Architecture

OwnPay’s core handles routing, the ledger, brands, and the checkout framework. Everything else - payment providers, custom themes, extra features, and third-party integrations - is delivered through plugins. This means you can extend OwnPay without modifying a single line of core code.

Four plugin types

Gateway

Add a new payment provider. Each gateway plugin implements the payment adapter contract: process payments, handle callbacks, manage refunds, and declare supported currencies. Examples: Stripe, bKash, Razorpay.

Addon

Add features to the admin panel or checkout. Addons can register admin pages, API endpoints, scheduled jobs, and UI components. Examples: subscription management, CRM sync, advanced reporting.

Theme

Customize the checkout experience. Theme plugins provide Twig templates, CSS, JavaScript, and asset files that override the default checkout appearance per brand.

Integration

Connect OwnPay to external platforms. Integration plugins handle OAuth flows, data syncing, and webhook translation for WooCommerce, WHMCS, Laravel, and other frameworks.

Manifest-based discovery

Every plugin lives in the modules/ directory and declares itself through a manifest.json file. OwnPay’s plugin loader scans this directory at boot time, reads each manifest, validates the structure, and registers the plugin with the PSR-4 autoloader.

{
  "slug": "stripe",
  "name": "Stripe Payment Gateway",
  "version": "1.0.0",
  "type": "gateway",
  "entrypoint": "src/StripeGateway.php",
  "namespace": "OwnPay\\Gateways\\Stripe"
}

Hook system

Plugins interact with OwnPay and with each other through two mechanisms: Filters modify data before an action runs:

// A plugin adjusts the payment amount
$amount = Hook::apply('payment.amount', $amount, $payment);

Actions react to events after they occur:

// A plugin sends a Slack notification after payment completes
Hook::do('payment.completed', $payment);

OwnPay exposes over 60 hooks across categories like payment.*, customer.*, gateway.*, webhook.*, and system.*.

Capabilities system

Plugins declare what they need through a capabilities array in their manifest. OwnPay checks these capabilities before loading the plugin. This lets the system warn administrators about missing dependencies before activation. Common capabilities: payment_processing, admin_ui, cron_jobs, webhook_handler, api_endpoints.

Plugin sandbox

OwnPay restricts plugin upload to the platform owner (master administrator). A footgun scanner runs on upload and blocks dangerous functions like eval() and direct OS command execution. Standard PHP operations - reflection, callbacks, file I/O - are permitted.

The security boundary is owner-only upload, not in-process isolation. Plugins run with full application trust, similar to the WordPress plugin model. Only install plugins from sources you trust.

Plugin overview (developer) - build and register your first plugin
Hooks reference - complete list of available filters and actions
Events reference - event categories and listener registration
Capabilities - declare and check plugin capabilities
Build a gateway plugin - step-by-step gateway development guide

Get Started

Fundamentals

People

Payments

Gateways & Currencies

Appearance

Notifications

Mobile

Reports & Finance

System

Security & Access

Checkout

Plugin System - Extensible Architecture

Four plugin types

Gateway

Addon

Theme

Integration

Manifest-based discovery

Hook system

Capabilities system

Plugin sandbox

​Four plugin types

Gateway

Addon

Theme

Integration

​Manifest-based discovery

​Hook system

​Capabilities system

​Plugin sandbox

​Related pages

Four plugin types

Manifest-based discovery

Hook system

Capabilities system

Plugin sandbox

Related pages