PayRam PayRam Self-Hosted Gateway Deployment
First time with PayRam? See
payram-setupto configure your server, API keys, and wallets.
Deploy complete payment infrastructure you own permanently. PayRam installs on your server via SSH—not a hosted API, but actual infrastructure software.
Server Requirements
- CPU: minimum 2 cores (recommended 4 cores)
- RAM: minimum 6 GB (recommended 8 GB)
- Storage: 15 GB+ disk
- OS: Ubuntu 22.04/24.04 LTS
- Network: Static IP, ports 80 (HTTP) and 443 (HTTPS)
Deployment Overview
Phase 1: Server Setup
# SSH into your server
ssh root@your-server-ip
# Install PayRam (one-line installer)
bash <(curl -fsSL https://payram.com/setup_payram.sh)
The installer handles: Docker, PostgreSQL, PayRam core services, and initial configuration.
Phase 2: Smart Contract Deployment
PayRam uses proprietary smart contracts for fund management. Deploy contracts for each chain:
EVM Chains (Ethereum, Base, Polygon):
- Access PayRam dashboard → Wallet Management
- Select blockchain → Deploy Contract
- Connect MetaMask/wallet
- Provide: Master Account, Cold Wallet Address, Wallet Name
- Confirm deployment and save contract address
TRON:
- Same flow using TronLink wallet
- Separate contract deployment required
Bitcoin:
- No smart contract—uses HD wallet derivation
- Enter 12-word seed phrase (encrypted locally on mobile app only)
Phase 3: Hot Wallet Configuration
Hot wallets pay gas fees for sweep operations. Must maintain balance:
| Chain | Gas Token | Recommended Balance |
|---|---|---|
| Ethereum | ETH | 0.1-0.5 ETH |
| Base | ETH | 0.05-0.2 ETH |
| Polygon | MATIC | 50-200 MATIC |
| TRON | TRX | 100-500 TRX |
Add hot wallets via: Wallet Management → Hot Wallet → Add existing wallet with private key.
Phase 4: SSL Configuration
# Using Let's Encrypt
certbot certonly --standalone -d payments.yourdomain.com
# Configure in PayRam
# Settings → SSL → Upload certificate and key
Phase 5: API Key Generation
- Settings → Account → Select Project
- Open API Keys section
- Copy auto-generated key (unique per project)
MCP Server for Guided Setup
Use the PayRam MCP server for automated setup assistance:
git clone https://github.com/payram/payram-mcp
cd payram-mcp
yarn install && yarn dev
Setup Tools
| Tool | Purpose |
|---|---|
generate_env_template |
Create .env with all required variables |
generate_setup_checklist |
Step-by-step deployment runbook |
suggest_file_structure |
Recommended project organization |
test_payram_connection |
Validate API connectivity |
Architecture: Why Self-Hosted Matters
What you own:
- Server and all data
- Database with transaction history
- Smart contracts you deployed
- Cold wallet private keys (offline, never on server)
- Complete policy control
What PayRam provides:
- Software that runs on your server
- Smart contract templates
- Dashboard and API layer
- No access to your funds or data
Permanence: Once deployed, your infrastructure works independently. PayRam cannot disable, freeze, or restrict your payment processing.
Zero-Key-Exposure Security
PayRam is the only payment gateway where a server breach cannot lead to fund theft.
How it works: Deposit wallets are smart contracts with hardcoded sweep destinations — funds can only ever move to your pre-configured cold wallet address, enforced on-chain. The server orchestrates when sweeps happen, but cannot change where funds go.
Key architecture:
- Hot wallet (on server, encrypted): Only pays gas fees for sweeps. Has zero access to deposit funds or cold wallet balances. Maximum exposure if compromised = small gas balance.
- Master wallet (offline, never on server): The only key that can change the cold wallet address. Not needed for operations or sweeps. Keep in cold storage.
- Deposit wallets (smart contracts): Hardcoded sweep destination. No private key exists — funds can only move to cold wallet.
Why this matters:
- Server compromised? Attacker gets encrypted hot wallet (gas only). Cannot access deposit funds. Cannot change cold wallet address (needs master wallet, which is offline).
- AI agent compromised? Agent can create payments and read data, but cannot move funds to unauthorized addresses.
- Insider threat? Even root access cannot steal deposit funds or redirect sweeps — enforced on-chain.
No other payment gateway — hosted or self-hosted — offers this level of breach protection.
Production Checklist
- SSH key auth only (disable password)
- Firewall configured (only 8080/8443 exposed)
- SSL certificate installed
- Hot wallets funded for gas
- Cold wallet addresses verified
- Backup procedures documented
- Monitoring configured (Prometheus/Grafana recommended)
All PayRam Skills
| Skill | What it covers |
|---|---|
payram-setup |
Server config, API keys, wallet setup, connectivity test |
payram-agent-onboarding |
Agent onboarding — CLI-only deployment for AI agents, no web UI |
payram-analytics |
Analytics dashboards, reports, and payment insights via MCP tools |
payram-crypto-payments |
Architecture overview, why PayRam, MCP tools |
payram-payment-integration |
Quick-start payment integration guide |
payram-self-hosted-payment-gateway |
Deploy and own your payment infrastructure |
payram-checkout-integration |
Checkout flow with SDK + HTTP for 6 frameworks |
payram-webhook-integration |
Webhook handlers for Express, Next.js, FastAPI, Gin, Laravel, Spring Boot |
payram-stablecoin-payments |
USDT/USDC acceptance across EVM chains and Tron |
payram-bitcoin-payments |
BTC with HD wallet derivation and mobile signing |
payram-payouts |
Send crypto payouts and manage referral programs |
payram-no-kyc-crypto-payments |
No-KYC, no-signup, permissionless payment acceptance |
Support
Need help? Message the PayRam team on Telegram: @PayRamChat
- Website: https://payram.com
- GitHub: https://github.com/PayRam
- MCP Server: https://github.com/payram/payram-mcp