Own your checkout.
Don't rent it.
Checkout, storefronts and subscriptions, shipped as source you deploy to your own account. Your Stripe keys. Your database. Your customer list. Nobody bills you monthly, because there is nobody in the path to send the bill.
$0
a month, at any volume. There is no paid tier and none is planned.
0%
of every sale. Money moves from your buyer to your Stripe account.
MIT
Read it, change it, fork it, sell the work. No attribution required.
A hosted checkout puts a company between you and your money. This one puts nothing there at all.
The case
The one page you cannot afford to rent.
Checkout is the last thing a buyer sees before money moves, and it is the page most sellers control least. That costs different people different things.
The rent never stops
A platform takes a fee every month, or a slice of every order, or both. You cannot touch the code. You cannot add the payment method your buyers keep asking for. Your customer list lives in a database you hold no copy of, on an account somebody else can close.
Seven carts in ten are abandoned
Rarely over price. It is being thrown to a domain nobody recognises, told to make an account to buy one thing, or watching the total move at the final step. Each of those was a decision the seller was never allowed to make.
Rolling your own is a season of work
Stripe Elements. Webhook signatures. Subscription state. Discounts, tax, invoices, abandoned carts, refunds. Every one of those is a place where a quiet bug takes real money out of a real account.
Rent it, or own it
The same checkout. A very different deal.
On the surface these look identical. What differs is who holds the keys, and what becomes of your shop on the day the company behind it changes its mind.
Rented
The $29-a-month model
- A subscription you pay every month, for as long as you sell, whether or not anything sold.
- "0% of sales" next to a flat monthly fee. At real-world volume that fee is a percentage wearing a hat.
- It runs on their servers. You upload your files and hope the lights stay on.
- You never read the code that stands between your buyer's card and your bank.
- If they fold, get bought, or get sued, your shop goes with them.
Owned
Charming Seal
- Nothing a month, for as long as it runs. You pay your host and you pay Stripe. Both start free.
- Genuinely 0% and $0. No account sits in the middle that could take a cut.
- It runs on your host and your Postgres. Money moves straight into your Stripe account.
- MIT licensed. Every line is readable. Change what you like. Fork it if we disappoint you.
- If the project stops tomorrow, your copy keeps taking orders. Nobody can deplatform you from your own server.
Do the sum on "free"
Three years of a checkout.
A flat fee is a percentage in a good suit.
"0% of your sales" only sounds generous once you are already doing volume. Run the honest version of the arithmetic.
Charming Seal charges nothing at any volume, because nobody is standing in the path to charge it. You pay Stripe's ordinary processing fee and whatever your host costs. On the free tiers that second number is zero.
What you actually do
It is an application. You run it.
Not a service. Nobody hosts it for you. It is a Next.js app you deploy to your own account with your own Stripe keys inside it, and when a buyer pays, Stripe moves the money to you.
Clone it
git clone, then npm install.
Fill in six values
Database URL, site URL, two generated secrets, and your Stripe test keys.
Create the tables
npx prisma db push. One command, one time.
Deploy
Push to GitHub, import in Vercel, paste the same six values.
Add a product
A name, a price, a URL slug.
Send the link
yoursite.com/pay/your-product. That is the sale.
The plates
Every screen, as it actually looks.
No illustrations and no marketing renders. A script drove a real browser against a running instance with a demo shop in it. These came back.
PLATE I · CHECKOUT
The page your buyer sees
Card, Link, PayPal, Klarna, Afterpay and crypto, on a page that loads quickly and looks like your shop rather than a payment form.
PLATE II · DESIGN
Theme it without touching CSS
Typeface, colours, button shape and input style, with a live preview of the exact page your buyers will land on.
PLATE III · STOREFRONT
A shop, not only a link
Products, collections and a cart on your own subdomain, built from the same catalogue as your checkout links.
PLATE IV · ANALYTICS
See what actually sold
Revenue, conversion and a checkout funnel, so you can tell which link made money rather than which link got clicks.
In the box
Six things you would have built yourself.
Every payment method
Card, Link, Klarna, Afterpay, PayPal and crypto.
Subscriptions
Weekly through yearly, billed by Stripe on your account.
Invoicing
Build, send and print invoices to PDF.
Discounts and upsells
Codes, order bumps, one-click upsells, referral codes.
Analytics
Revenue, conversion and UTM attribution.
Abandoned carts
Recovery mail through your own sender.
Built for agents
Let an agent run the shop.
Other tools let an AI build you a page. Charming Seal ships an MCP server, so Claude, Cursor or any MCP client can work the shop itself: read the orders, move a price, hand you a live checkout link.
Connect it in one command. Nothing to install.
claude mcp add --transport http charming-seal \ https://your-domain.com/api/mcp \ --header "Authorization: Bearer csk_live_your_key"
The MCP server is part of your instance — if the shop is running, the endpoint is already live. Generate the key in Settings → API Keys. There is no package to install and nothing to keep updated.
Prefer it running locally? Build it from the repo you already cloned.
$ cd mcp-server && npm install && npm run build $ claude mcp add charming-seal \ --env CHARMING_SEAL_URL=https://your-domain.com \ --env CHARMING_SEAL_API_KEY=csk_live_your_key \ -- node ./mcp-server/dist/index.js
Either way, prove it works, so a silent failure never surprises you.
$ node ./mcp-server/dist/index.js --self-test ✓ reach instance + authenticate GET /api/v1/settings ✓ read products GET /api/v1/products ✓ read orders GET /api/v1/orders ✓ 8 tools ready
list_products | Live, active products in the catalogue |
get_product | One product, including drafts, hidden and archived |
create_product | Makes a product and returns its checkout link |
update_product | Price, name, description, state |
delete_product | Removes a product from the catalogue |
list_orders | Recent orders, filterable by status |
get_settings | Shop name, theme and configuration |
update_settings | Change the shop's settings in place |
Setup for Claude Desktop, Cursor and generic MCP clients is in the MCP guide.
Security
What was actually done.
This software moves money, so "trust us" is worth nothing. Before it went public every one of its 103 API routes was read end to end. Here is what that produced, including the parts that are not finished.
| Sessions | Rewritten to random tokens with server-side revocation. The session secret never reaches the browser. |
| Tenant isolation | One API key could read and reprice another shop's products. Closed, along with cross-tenant writes in the payment webhooks. |
| Payment integrity | Price, discounts, bumps and currency are recomputed on the server. A client cannot change what it is charged. |
| Credentials | Stripe keys encrypted at rest with AES-256-GCM. API keys stored only as hashes. |
| XSS and SSRF | A regex sanitiser replaced with a real HTML parser. Outbound fetches resolve DNS and refuse private ranges. |
| Rate limiting | Durable and Postgres-backed, per IP and per tenant. Optional Cloudflare Turnstile on public forms. |
Enquiries
Answered without the sales voice.
What does it cost?
Nothing. MIT licensed, no paid tier, no locked features. You pay Stripe's ordinary processing fee and whatever your host and database cost, which can be zero on free tiers.
Do you take a cut of my sales?
No, and there is no mechanism by which we could. Your Stripe keys live in your deployment. Money moves between your buyer and your Stripe account. Nothing passes through infrastructure anyone else controls.
Is it ready for real money?
It runs a real shop today, and every one of its 103 API routes was read line by line before release — the findings, including what is still open, are published in SECURITY.md. Start in Stripe test mode, take a test order, and satisfy yourself before you point buyers at it. If you want a support contract, buy a hosted product. That is a fair choice and we will not argue with it.
What happens if it breaks at two in the morning?
That is you. There is no support desk. This is the real trade for keeping the fees and the data, and it is worth being honest with yourself about whether you want it.
Do I need to be a developer?
To run it, no, but you need to be comfortable with a terminal, environment variables and a hosting dashboard. If git clone means nothing to you, this will be a long afternoon.
Can I use it for clients?
Yes. MIT means you can modify it, deploy it and charge for the work, with no attribution required. You become their support desk.
Free, and staying that way
Take it. It's yours.
No paid tier is planned. If Charming Seal earns you money and you would like it maintained, sponsorship is what funds the work, and a star genuinely helps other people find it.
Charming Seal closes deals.