medusa
The world's most flexible commerce platform.
The Lens
By Erik Loyd, SaaS CEO and former COO/CFO of an AWS Premier Partner.
Updated Aug 2026
Medusa is a headless commerce engine written in TypeScript. Products, carts, orders, payments, fulfillment, and multi-region selling arrive as modules you wire into your own storefront. It is the plumbing under a custom shop, not a theme you install. The core is MIT with no GMV fee and no order limits, and as of August 2026 that sentence needs an asterisk.
On 2026-08-11 the project added an Enterprise Edition license. RBAC (role-based access control) and SSO (single sign-on) now sit in the repository under a proprietary notice: you can read the source, you are not granted the rights, and flipping the feature flag counts as asserting you hold a commercial agreement. Gating auth and permissions is the fair kind of monetization and they have to make money somewhere. But the pitch that every module stays free regardless of plan is dead, and better to learn that now than during a security review.
Self-hosting is real work: Postgres, Redis, workers, and uptime are yours. Medusa Cloud runs $29 a month for a development environment, $99 for production with autoscaling and backups, and $299 for background workers, with extra seats at $30. Saleor (saleor/saleor) and Vendure (vendurehq/vendure) are the alternatives worth pricing, and neither has taken a module proprietary.
The catch: read the Enterprise Materials path list before you commit. If your roadmap includes staff roles, granular permissions, or company SSO, that is a sales call now, not a config change. Code released under MIT before August 11 keeps its MIT rights, so existing installs are safe, but future versions of those directories are not.
Free vs Self-Hosted vs Paid
open coreFree
The commerce core under MIT: unlimited orders, products, and sales channels, no GMV tax, no license key. Cart, pricing, inventory, fulfillment, promotions, payments, the admin dashboard, and the storefront starters are all included, and you can export your data and self-host at any time.
Paid
Two separate things now, and they are easy to confuse.
Enterprise Edition license (new on 2026-08-11). RBAC and SSO ship inside the repository but are not MIT. ENTERPRISE-LICENSE.md lists the exact paths, covering the RBAC module, policy middleware, role and permission workflows, the admin roles and policies routes, and the SDK clients. Using them requires a commercial agreement with MedusaJS, pricing is custom, and the notice is explicit that possessing the source grants no license. Anything released under MIT before that date keeps its MIT rights.
Medusa Cloud, per month:
- Develop, from $29: GitHub deploys, PR previews, 1 shared server, 600 compute hours, 1M edge requests, 1,000 emails a month.
- Launch, from $99: autoscaling, custom storefront domains, automatic backups, Redis-backed KV, 2 shared servers, 800 compute hours, 5M edge requests, 1 seat then $30 per additional seat.
- Scale, from $299: background workers, priority support, 3 seats, longer backup retention, 10M edge requests, custom backend domain.
- Enterprise, custom: the Enterprise License itself plus RBAC, SSO, audit logs, BYOC, 99.99% uptime, SOC2, data sovereignty, and a dedicated support engineer.
Self-Hosted Costs
Postgres, Redis, a Node server process, a worker process, and object storage. A modest production setup lands somewhere around $50 to $150 a month on a VPS or a small managed stack, before any of your own engineering time. The storefront is a separate application you build, host, and maintain yourself.
When to Pay
Go Cloud when you would rather ship features than run workers and restore backups. Pay for Enterprise when you need staff permissions or company SSO, because those are no longer something you can self-host your way around.
Commerce core still MIT and free to self-host, but RBAC and SSO moved to a proprietary Enterprise license on 2026-08-11. Cloud runs $29 to $299 a month; Enterprise is custom.
What to do by team size
- Solo
- free to self-host, but Cloud at $29 a month is the honest answer if you would rather build the storefront than babysit Redis.
- Small team
- self-host, or take Launch at $99. You will not miss RBAC at this headcount.
- Medium team
- self-host with a real ops owner, or Scale at $299. Watch the seat math, since extra Cloud seats are $30 each.
- Large team
- budget for Enterprise. RBAC, SSO, and audit logs are gated behind it now, and those are table stakes at your size.
Get tools like this every Wednesday
One featured tool, three on the radar. No fluff.
Similar Tools
A low score is not a verdict on quality. Young and niche tools start low by design. How we calculate scores
Trust Signals
About
- Stars
- 36,485
- Forks
- 5,303
Explore Further
More tools in the directory
openclaw
Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞
390.6k ★everything-claude-code
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
268.1k ★hermes-agent
The agent that grows with you
249.3k ★