Payload: An API-First, Open Source, Headless CMS You Actually Own
Most marketing teams do not want to own a Content Management System (CMS). They want to publish. The catch is that the Software as a Service (SaaS) that makes publishing easy also owns the schema, the database, and the exit. When the next site, app, or storefront needs the same content, the team is negotiating an export, not shipping a feature.
Engineering teams have the opposite problem. A headless CMS that is only an admin UI still hides the model behind clicks. Marketers cannot preview. Developers cannot review a content model in git. The stack that works is the one where the schema is code, the admin is generated from it, and the Application Programming Interface (API) layer is a byproduct rather than a second project.
I met with a fellow marketing professional and founder, Shawn Schwegman, and he showed me multiple projects he developed using AI on Payload. I was amazed!
Payload
Payload is an open-source, TypeScript headless CMS and Next.js framework. You describe collections and globals in config, and it generates a React admin, database migrations, and Representational State Transfer (REST), Graph Query Language (GraphQL), and in-process APIs from that same file.
The practical difference is who holds the keys. Self-hosted Payload is MIT-licensed and free. MongoDB, Postgres, or SQLite is yours. Deploy on Vercel, Cloudflare, Docker, or any Node 20.9+ host. The first-party Cloud product is in flux after Payload joined Figma in June 2025. The open-source core remains MIT, and existing Cloud customers were told they will migrate rather than lose a running app overnight.
Payload says its GraphQL API is 700% faster than competitors, and a May 2025 company post put npm weekly downloads on a 3x run, from 35,000 to 100,000 in a year. Named customers on the site include Microsoft, Mazda, Vodafone, Sonos, ASICS, and Blue Origin.
Utilizing Payload enabled us to implement our digital postcards tool quickly and easily, engaging thousands of K-12 students.
Heather Nelson, Director at Blue Origin’s Club for the Future
The same Payload write-up says content updates moved 10x faster from collaboration to publish. It is not Webflow. Editors get live preview, localization, drafts, and a form builder. They do not get a GUI that invents the schema. If the marketing site, the storefront catalog, and an internal tool need to share a model, that constraint is the point.
What Ships in the Config
Open-source Payload is the CMS, the admin, and the APIs. Enterprise adds visual editing, identity, workflows, and AI on top of the same config, not a second product.
- Access Control: Function-based rules at the collection, document, field, and operation level, so a marketer, an agency partner, and an API key do not share one blunt role.
- Admin Panel: A generated React UI you can swap components in and white-label. The panel lives in the Next.js app rather than on a rented hostname.
- APIs: REST and GraphQL generated from the config, plus a Local API that hits the database in-process from React Server Components with no HTTP hop.
- Authentication: Built-in users, verification, and lockout, reusable on your own frontends rather than bolted on as a third auth product.
- Form Builder: An official plugin for forms that write into collections, so lead capture is content, not a separate SaaS.
- Live Preview: The frontend rendered inside the admin so editors see the page, not only the fields.
- Localization: Field-level locales, including right-to-left scripts, without a second CMS per language.
- Plugins: Official packages for Search Engine Optimization (SEO), redirects, search, nested docs, multi-tenant, Stripe, Sentry, ecommerce, and import/export. Storage adapters cover S3, Azure Blob, Google Cloud Storage, Vercel Blob, and Cloudflare R2.
- Single Sign-On: Enterprise Single Sign-On (SSO) through Security Assertion Markup Language (SAML) or Open Authorization (OAuth) 2.0 identity providers, rather than a shared admin password in a password manager.
- Uploads: Media with resize, focal-point crop, folders, and access rules, which is why Payload also positions the same stack as Digital Asset Management (DAM).
- Versions and Drafts: History, draft preview, and rollback so a bad publish is a revert, not a restore from backup.
- Visual Editor: An Enterprise in-context editor for text, images, and layout on the live site, plus publishing workflows, multiplayer editing, and AI assists (translations, image generation, writing) that sit on the same collections.
That list is one backend. A marketing site, a headless catalog (payments stay in Stripe), and an internal admin can share it. Payload is not trying to be the storefront or the design tool. It is trying to be the model you still own when those change.
Getting Started
Scaffold a Payload project, point it at a database, and deploy. Official templates land on Vercel (Neon and Blob) or Cloudflare (D1 and R2) in one click. Self-hosted core is $0. Enterprise (visual editor, SSO, workflows, dedicated support) is a demo with sales, not a public price card.
npx create-payload-app@latestIf the job is a Next.js site whose content model should live in git, start there. If the job is SSO and in-context editing for a larger org, start with the demo.
