Self-hosting

What you get

• The full platform: checkout, dashboard, API, devices and webhooks.
• A licence key valid for one production domain for 12 months.
• Updates, security patches and email support for the licence period.
• White-label checkout with your own logo and colours.

Requirements

• A server with 2 vCPU, 2 GB RAM and 20 GB SSD (a ৳600/month VPS is enough for most stores).
• Node.js 20 or newer, or Docker.
• A domain with HTTPS. Webhooks and device ingestion will not work over plain HTTP in production.
• A MongoDB database. MongoDB Atlas (free tier works) or any MongoDB 6+ server. The app also deploys to Vercel with an Atlas connection string.

Install

# 1. Pull the release
curl -fsSL https://get.takaflow.app/self-hosted | sh

# 2. Configure
cp .env.example .env.local
# set MONGODB_URI, MONGODB_DB, SESSION_SECRET, NEXT_PUBLIC_SITE_URL, CRON_SECRET
# optional: PLATFORM_ADMIN_EMAILS=you@example.com to open the /admin console
# optional: SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS, EMAIL_FROM for email

# 3. Build and start
npm run build
npm run start

# 4. Wake the automation loop every minute (retries, expiry, offline alerts)
curl -H "Authorization: Bearer $CRON_SECRET" https://your-domain.com/api/cron/tick

Email and password resets

Transactional email uses SMTP. Set SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS and EMAIL_FROM, plus an optional EMAIL_REPLY_TO. When SMTP is not configured, development builds write messages to the email_outbox collection instead of sending them, so the reset flow stays testable without exposing links in server logs. Production without SMTP skips delivery and the forgot-password page still returns a generic response.

Password reset links expire after 60 minutes and work once. Completing a reset invalidates every existing session for that user; changing a password from the dashboard does the same. Forgot-password, login and registration endpoints are rate limited per email and per IP, and the API, device and checkout endpoints all carry their own limits.

Platform console

The operator console lives at /admin. Add comma-separated emails to PLATFORM_ADMIN_EMAILS to grant access, or grant it per user from the console. Platform admins can change plans, suspend or restore workspaces, reset passwords, approve or refund payments, reconcile SMS, revoke devices, retry webhooks and publish a dashboard announcement.

Every console mutation is written to the admin_audit collection. Suspending a workspace blocks merchant login, checkout, dashboard writes, API keys and device ingestion while keeping all records intact.

Automation loop

NaklaPay retries failed webhooks, expires stale invoices, flags devices that miss heartbeats and reconciles late SMS in one background pass. The pass runs opportunistically on checkout and dashboard traffic, and is guaranteed by /api/cron/tick.

On Vercel, add the same CRON_SECRET as an environment variable; the included vercel.json calls the endpoint daily (Hobby plan limit) while live traffic keeps it fresh. On your own server, call it every minute from cron or a systemd timer.

Licence behaviour

The software checks the licence key against the NaklaPay licence server once a day and stays fully operational for 14 days if the check cannot complete. If a licence lapses, data stays intact and the dashboard remains accessible for export; new charges are paused.

Data ownership

Your database, your backups, your customers. NaklaPay receives licence heartbeats only — no transaction data, no SMS content and no customer records leave your server.