A checkout page builder you host yourself
Order forms, bumps and post-purchase upsells you design and serve from your own domain. The card number goes from the browser straight to Stripe or PayPal, and never through your server.
curl -O https://raw.githubusercontent.com/autonnel/autonnel/master/docker-compose.yml
docker compose upNo Node, no database setup, no account. Opens on localhost:4321.
The actual editor, unedited. No mockups on this page.
Autonnel vs Hosted checkout builders
The right-hand column describes the common shape of hosted checkout and funnel products, not one specific vendor.
| Autonnel | Hosted checkout builders | |
|---|---|---|
| Who hosts the checkout page | You do, on your own domain and your own deployment. Node, Docker or Cloudflare Workers. | The vendor, on their domain or a subdomain they control. |
| Where the card number goes | From the browser straight to Stripe or PayPal. Your server receives a payment method reference, never a card number. | Also to the processor, but through the vendor infrastructure as well as yours. |
| What you can edit | The whole page. Drag-and-drop blocks, raw HTML, or AI generation from a prompt, plus the templates underneath. | The fields and sections the builder chose to expose. |
| Order bumps and post-purchase upsells | Built in. The upsell reuses the buyer attached at the main checkout, so there is no second card form. | Often a paid add-on, sometimes priced per order. |
| Cost model | $0 self-hosted at any volume. Managed cloud is a flat $29/mo and takes 0% of revenue. | Subscription tiered by traffic, funnels or order volume. |
| Payment providers | Stripe and PayPal, configured in Settings with your own keys. | Whatever the vendor has integrated, sometimes routed through their merchant account. |
| Data you keep | Your Postgres. Orders, customers, sessions and analytics are rows you can query and export. | Exportable to the extent the vendor allows. |
| Source code | Apache-2.0. The checkout path is readable and forkable. | Closed. |
On checkout and upsell pages the card form is a Stripe Elements iframe served from Stripe origin. Your JavaScript cannot read those fields and neither can a script someone pasted into the page. The browser exchanges the card for a pm_ reference, and that reference is the first thing your infrastructure ever hears about the payment.
The order form, the bump and the post-purchase offer are steps on the same canvas as the landing page, sharing one session and one buyer. That is why the upsell can capture without asking for a card again, and why the step-by-step conversion numbers exist without stitching two tools together.
Checkout pages use the same editor as everything else: drag-and-drop blocks, a raw HTML escape hatch, and AI generation from a prompt. Page content is stored as diffable JSON with a draft and a published version, so you can edit, verify, then promote.
Self-hosting means you run the deployment, the Postgres and the updates, and your cardholder data environment is yours to describe even though the card number never lands in it. There is also a concrete limitation worth knowing before you commit: redirect-based 3DS flows are not supported and will decline. Pick a hosted checkout when none of that is a trade you want to make. Pick this when you want the page, the data and the funnel logic to be yours, and you would rather read the checkout code than file a support ticket about it.
FAQ
Does the card number touch my server?
No. With Stripe, the card form is an iframe from Stripe origin and the browser calls createPaymentMethod, so your server receives a pm_ reference. With PayPal the flow is equivalent. What lands in your Postgres is a token, an amount and a status.
Does that make me PCI compliant?
No, and no software can be compliant on your behalf. Compliance is a property of your whole cardholder data environment, your integration choices and your transaction volume. What we can do is describe the mechanism precisely, which the Stripe and PayPal setup docs do. Confirm your own SAQ type and validation route with your acquirer or a QSA.
Are there limitations I should know about first?
Yes. Redirect-based 3DS flows are not supported and will decline; in-frame 3DS via handleCardAction works. This is documented in the Stripe setup docs rather than buried.
Can I keep Shopify or WooCommerce as the backend?
Yes. The commerce adapter handles Shopify, WooCommerce, or Picocart, our own open-source commerce backend. Products come from the platform and the finished order is written back to it.
What do I actually have to run?
Autonnel, a Postgres database, and an S3-compatible bucket if you upload media. Everything else is optional and configured in Settings when you need it. The docker compose file starts the first two for you.
Can I run it without self-hosting?
Yes. The managed cloud runs the same Apache-2.0 code for a flat $29 a month with no percentage of revenue, and you can move to your own deploy later without rebuilding the funnels.