Open a booth.
Hold no keys.

Take Lightning, on-chain bitcoin and Monero payments on your own servers. You decide what you sell and how you get paid, and the server holds almost nothing worth stealing.

See how it works

Star SatBooth on GitHub

Or install the release candidate →

Fig. 1 · where the money can and cannot go

01 · ANYONE

Customer

pays in sats, BTC or XMR on the checkout page

02 · PUBLIC HOST · faces the internet

SatBooth

watch-only xpub · no keys
view-only Monero login · no spend key
scoped NWC link · budgeted

NWCtrustboundary

03 · HUB HOST · separate machine

Small Lightning hub

small channels, a hub-enforced payout budget, swept regularly to your main node or cold storage

IF THE PUBLIC HOST FALLS · ON-CHAIN
The attacker sees addresses and payments. Spends nothing.
IF THE PUBLIC HOST FALLS · MONERO
The attacker sees incoming payments and, through the login, can read the view key and fake payments to SatBooth. Spends nothing.
IF THE PUBLIC HOST FALLS · LIGHTNING
The loss is capped by the hub’s channel size and payout budget.

No one between you and your customer.

No processor to approve your shop. No account that can be frozen overnight. No list of goods someone else decided you may not sell.

If it is legal, the law is your only rulebook. SatBooth runs on your machines and, by default, makes no third-party calls and sends no telemetry.

Self-hosted payment servers usually keep spendable keys on the machine that faces the internet. SatBooth starts from the opposite assumption.

Two hosts. Four steps.

A setup command writes every configuration file and generates every secret, with no network, in a pinned image. Images are reproducible and attested; the release tag is signed.

Moving from BTCPay? Read the migration guide →

01publicdeploy/setup.sh <dir> public init
02hubdeploy/setup.sh <dir> hub init
03hubdeploy/setup.sh <dir> hub pair
04publicdeploy/setup.sh <dir> public finish

Read the docs

RunningThe relay, pairing and the service Merchant APICreate and read orders Threat modelWhat we defend against, and how From BTCPayWhat moves, what does not

Common questions

Is it ready for real money?

No. SatBooth is a release candidate, tested on regtest. Nothing has run on mainnet yet.

Does it cost anything?

The software is free and open source under the Apache License 2.0, with no vendor accounts and no telemetry. Running it costs what your hosts, nodes and channels cost.

Why two hosts?

So that a compromise of the public host reaches no further than its scoped, budgeted link to the hub. The Lightning bound holds only if the hub runs on a different host.

Do I need to run my own nodes?

Yes: your own bitcoind, a dedicated Alby Hub on the hub host for Lightning, and your own monerod if you take Monero. The setup command writes the configuration of a dedicated bitcoind on the hub host.

Can it replace BTCPay Server?

For checkout over Lightning, on-chain bitcoin and Monero, it can take its place. It has no stores, point-of-sale apps or pull payments. Read the migration guide →

SatBooth is open source and new. Stars help merchants who need it find it.