Tools/medusajs/medusa

medusa

The world's most flexible commerce platform.

37.2k ★+88/wkgrowthTypeScriptMIT License →trending

The Lens

By Erik Loyd, SaaS CEO and former COO/CFO of an AWS Premier Partner.

Updated Oct 2026

Medusa is a headless commerce engine in TypeScript: products, carts, orders, payments, pricing and fulfillment arrive as modules you wire into your own storefront. It's the plumbing under a custom shop, not a theme you install. The core is MIT with no GMV fee and no order limits, with one asterisk.

Since August 11, 2026, RBAC (staff roles and permissions) and SSO (company login over OIDC) sit in the repo under a proprietary Enterprise license. Reading the code grants no rights, and enabling an Enterprise feature flag counts as claiming a commercial agreement. Charging for auth is fair. A pricing page promising "no special licenses" next to it is not.

Self-hosting means Postgres, Redis, a server instance plus a worker instance, Node 22, and a storefront you build and host. Medusa Cloud is $29/mo (Develop), $99/mo (Launch, autoscaling and backups) or $299/mo (Scale, background workers), with extra developer seats at $30; admin users are free. Solo: self-host or Develop. Small teams: Launch. Medium teams: Scale. Larger teams: Enterprise, priced by sales.

The catch: staff permissions and company SSO are a sales call now, not a config change. Saleor (BSD) and Vendure (GPLv3) are worth pricing first.

Free vs Self-Hosted vs Paid

open core

Free: The commerce core is MIT: products, carts, orders, pricing, payments, inventory, fulfillment, the admin dashboard and the Next.js starter storefront, with no GMV fee and no order or product limits. Everything except the Enterprise Materials listed in ENTERPRISE-LICENSE.md.

Self-hosted: Needs Node.js 22.22 or later, PostgreSQL, Redis, and two deployments of the app (one in server mode for the API and admin, one in worker mode for scheduled jobs and subscribers), plus production Redis modules for caching, events, workflows and locking. The storefront is a separate app you host. RBAC and OIDC SSO code ships in the repo but is proprietary since 2026-08-11: using it requires a commercial agreement with MedusaJS, and code released under MIT before that date keeps its MIT rights.

Paid: Medusa Cloud, billed monthly: Develop from $29/mo (1 shared server, 600 compute hours capped, 1M edge requests, 1,000 emails a month hard limit, 1 Cloud seat). Launch from $99/mo (autoscaling, custom storefront domains, automatic backups with 7-day retention, Redis-backed KV, 2 shared servers, 1,000 compute hours then $0.16/hr, 5M edge requests, 1 seat). Scale from $299/mo (background workers, priority support, semantic search, 14-day backups, 10M edge requests, custom backend domain, 3 seats). Extra Cloud seats $30/seat/mo; Medusa Admin users are unlimited and free; edge requests $0.3 per 1M over the allowance. Enterprise is custom: the Enterprise License with RBAC, SSO and audit logs, BYOC, 99.99% uptime guarantee, SOC2, dedicated support engineer.

The MIT core is free to self-host with no GMV fee, and Cloud runs $29, $99 or $299 a month plus $30 per extra developer seat. Staff roles and SSO need an Enterprise license at a custom price, even if you self-host.

What to do by team size

Solo
free to self-host, or Develop at $29/mo if you'd rather build the storefront than run Redis and a worker
Small team
free self-hosted with someone who owns ops, or Launch at $99/mo for autoscaling and backups
Medium team
Scale at $299/mo with 3 seats, or self-host with a real ops owner; watch the $30 seat math
Large team
Enterprise, custom priced; RBAC, SSO and audit logs are Enterprise-only now
Self-hosting ops:significant
View pricing page →

Get tools like this every Wednesday

One featured tool, three on the radar. No fluff.

Similar Tools

Score
88/100 · A
Adoption27/30
Maintenance25/25
Community11/20
License15/15
Analysis10/10

A low score is not a verdict on quality. Young and niche tools start low by design. How we calculate scores

Trust Signals

High adoption: 32,669 starsActive community: 4,265 forksPermissive license (MIT)

License: MIT License

RBAC and OIDC SSO paths are proprietary Enterprise Materials needing a commercial agreement since 2026-08-11.

Commercial use: ✓ Yes

About

Stars
37,196
Forks
5,513

Explore Further

More tools in the directory