There are many ways to deploy Payload to a production environment. When evaluating how you will deploy Payload, you need to consider these main aspects:
Payload can be deployed anywhere that Next.js can run - including Vercel, Netlify, SST, DigitalOcean, AWS, and more. Because it's open source, you can self-host it.
But it's important to remember that most Payload projects will also need a database, file storage, an email provider, and a CDN. Make sure you have all of the requirements that your project needs, no matter what deployment platform you choose.
Often, the easiest and fastest way to deploy Payload is to use Payload Cloud — where you get everything you need out of the box, including:
Payload runs fully in Next.js, so the Next.js build process is used for building Payload. If you've used create-payload-app to create your project, executing the build
npm script will build Payload for production.
Payload features a suite of security features that you can rely on to strengthen your application's security. When deploying to Production, it's a good idea to double-check that you are making proper use of each of them.
When you initialize Payload, you provide it with a secret property. This property should be impossible to guess and
extremely difficult for brute-force attacks to crack. Make sure your Production secret is a long, complex string.
Because you are in complete control of who can do what with your data, you should double and triple-check that you wield that power responsibly before deploying to Production.
Depending on where you deploy Payload, you may need to provide a start script to your deployment platform in order to start up Payload in production mode.
Note that this is different than running next dev. Generally, Next.js apps come configured with a start script which runs next start.
You should be using an SSL certificate for production Payload instances, which means you can enable secure cookies in your Authentication-enabled Collection configs.
Payload comes with a robust set of built-in anti-abuse measures, such as locking out users after X amount of failed
login attempts, GraphQL query complexity limits, max depth settings, and
more. Click here to learn more.
Payload can be used with any Postgres database or MongoDB-compatible database including AWS DocumentDB or Azure Cosmos DB. Make sure your production environment has access to the database that Payload uses.
Out of the box, Payload templates pass the process.env.DATABASE_URI environment variable to its database adapters, so make sure you've got that environment variable (and all others that you use) assigned in your deployment platform.
When using AWS DocumentDB, you will need to configure connection options for authentication in the connectOptions
passed to the mongooseAdapter . You also need to set connectOptions.useFacet to false to disable use of the
unsupported $facet aggregation.
When using Azure Cosmos DB, an index is needed for any field you may want to sort on. To add the sort index for all fields that may be sorted in the admin UI use the indexSortableFields configuration option.
If you are using Payload to manage file uploads, you need to consider where your uploaded files will be permanently stored. If you do not use Payload for file uploads, then this section does not impact your app whatsoever.
Some cloud app hosts such as Heroku use ephemeral file systems, which means that any files
uploaded to your server only last until the server restarts or shuts down. Heroku and similar providers schedule
restarts and shutdowns without your control, meaning your uploads will accidentally disappear without any way to get
them back.
Alternatively, persistent filesystems will never delete your files and can be trusted to reliably host uploads perpetually.
Popular cloud providers with ephemeral filesystems:
Popular cloud providers with persistent filesystems:
If you don't use Payload's upload functionality, you can completely disregard this section.
But, if you do, and you still want to use an ephemeral filesystem provider, you can use one of Payload's official cloud storage plugins or write your own to save the files your users upload to a more permanent storage solution like Amazon S3 or DigitalOcean Spaces.
Payload provides a list of official cloud storage adapters for you to use:
Follow the docs to configure any one of these storage providers. For local development, it might be handy to simply store uploads on your own computer, and then when it comes to production, simply enable the plugin for the cloud storage vendor of your choice.
This is an example of a multi-stage docker build of Payload for production. Ensure you are setting your environment
variables on deployment, like PAYLOAD_SECRET, PAYLOAD_CONFIG_PATH, and DATABASE_URI if needed.
Here is an example of a docker-compose.yml file that can be used for development