Skip to main content
Common questions about OwnPay, organized by topic.

​
General

OwnPay is a self-hosted, open-source payment orchestrator. It lets a single platform owner run multiple white-labeled payment brands (stores) from one installation, with 123+ payment gateways, a double-entry ledger, and full data isolation between brands.
Yes. OwnPay is released under the AGPL-3.0 license. You can download, install, and use it without paying any license fees. You only pay the transaction fees charged by your chosen payment gateways (Stripe, bKash, etc.), not to OwnPay.
AGPL-3.0 (GNU Affero General Public License). This means you can use, modify, and distribute OwnPay freely, but any modifications you serve over a network must also be made available under the same license. See the Contributing Guide for details on licensing of contributions.
OwnPay ships with 123 built-in gateway adapters covering global card processors (Stripe, Adyen, Square), digital wallets (PayPal, Apple Pay, Google Pay), mobile financial services (bKash, Nagad, M-Pesa, GCash), buy-now-pay-later (Klarna), crypto (Coinbase Commerce), and regional platforms (Razorpay, Flutterwave, Paystack, Xendit, and many more).
No. OwnPay is infrastructure you deploy and own on your own server. No third party has access to your transactions, customer data, or configuration.

​
Technical

PHP 8.3 or higher. OwnPay uses declare(strict_types=1) throughout and relies on PHP 8.3 features like readonly properties and typed class constants.
MySQL 8.0 or MariaDB 10.4+. OwnPay uses InnoDB for all tables and relies on Stored Generated Columns for JSON field indexing.
No, but it is strongly recommended. OwnPay works with file-based cache and sessions by default, but Redis provides significantly better performance for rate limiting, sessions, and the job queue. Switch to Redis when you expect more than 1,000 payments per day.
Yes. While there is no official Docker image yet, the community maintains Docker Compose configurations. OwnPay’s single-entry-point architecture (public/index.php) makes it straightforward to containerize with any PHP 8.3 base image.
Yes. OwnPay includes a web-based installer that requires no CLI access. The vendor/ directory is bundled in release archives, so you do not need Composer on the server. You need PHP 8.3 support and a MySQL database.

​
Security

OwnPay uses a gateway delegation model - credit card data is collected and processed directly by upstream gateways (Stripe, Adyen, etc.) and never touches your server. This typically places OwnPay under SAQ-A, the simplest PCI self-assessment level. Consult a QSA for your specific deployment.
Customer PII (names, emails, phone numbers) and gateway API credentials are encrypted at rest using AES-256-GCM with a per-installation key. Webhook payloads are signed with HMAC-SHA256. All traffic uses HTTPS with HSTS enforced.
OwnPay provides the technical tools for GDPR compliance: data minimization, encrypted storage, hash-based lookups, data export (CSV), and data deletion with ledger anonymization. As a self-hosted platform, you are the data controller and are responsible for your own GDPR processes and policies.

​
Payments

See the full list on the Features page under “Payment Gateway System.” The list includes 123 adapters across cards, wallets, MFS, crypto, and regional platforms.
Yes. OwnPay supports manual gateways where you configure custom fields (bank account number, reference number) and verify payments manually or via the SMS auto-verification system with the companion app.
The OwnPay Android companion app forwards incoming SMS from payment providers to your server. The server parses the SMS using regex and heuristic patterns, extracts the transaction amount and ID, and automatically matches it to a pending payment intent. See the Features page for details.

​
Development

Plugins are self-contained packages under modules/ with a manifest.json that declares metadata, capabilities, and hook registrations. Three types exist: Gateway, Theme, and Addon. All plugins are scanned by a static code sandbox before loading. See the Plugin Development Overview.
Merchant API: 60 requests/minute per API key. Login attempts: 10 per 5 minutes per IP. Global: 120 requests/minute per IP. See the Rate Limiting page for the full reference.
You register a webhook URL per brand in the admin panel. OwnPay sends signed HTTP POST requests (HMAC-SHA256) when payment events occur. Failed deliveries are retried with exponential backoff. See the Code Examples page for verification code.
Yes. OwnPay provides official SDKs for PHP, Laravel, and Node.js. Community-maintained SDKs exist for Python, Go, and Java. See the Ecosystem page for links and installation instructions.
Last modified on August 25, 2026