Commerce modules and workflows behind an Express server
Medusa is a headless commerce platform written in TypeScript. Its Node.js server, built on Express, exposes Store and Admin API routes, where workflows hold the business logic and call one module per domain (products, carts, orders, pricing, payments, inventory), with the data kept in PostgreSQL. A web shop, a mobile app or a till all go through that API, and create-medusa-app can scaffold a Next.js starter storefront.
Modules that also install into a plain Node.js app
- Decoupled commerce modules: a Medusa application ships with all of them, and the docs also cover installing them on their own from npm, in any Node.js project or a serverless app such as Next.js.
- Extensible data models: the framework adds custom fields to existing models, along with your own API routes, data models and workflows.
- Multi-region built in: as many regions as you need, one currency per region, tax rates per country, and checkout taxes computed from the shipping address.
- Admin included: the server hosts the merchant dashboard, and the repo ships the SDK and Vite plugin used to extend it, plus Medusa UI, a React component library.
- Replaceable providers: Stripe, S3, SendGrid and Redis come as modules, and the docs state that every third-party service can be swapped out.
Distributor portals, tills and hand-built marketplaces
- B2B, direct-to-consumer or distributor storefronts with rules a standard platform won't accommodate
- An in-store point of sale, in whatever stack you like, sharing sales channels and warehouses with the web store through the REST API
- Multi-vendor marketplaces, where the official recipe has you write your own vendor module and link it to products and orders
Paid RBAC and SSO, plus a Redis-backed worker in production
The repository went open core in August 2026. The LICENSE file, rewritten on 11 August 2026, keeps MIT for the core and points to ENTERPRISE-LICENSE.md: role-based access control (RBAC) and OIDC single sign-on require a commercial agreement with MedusaJS, Inc., even though their code is public. Turning on their feature flag counts as a statement that you hold that agreement, and v2.22.0 added license key checks. Email, GitHub and Google login stay under MIT, as do earlier releases. The pricing page lists RBAC and SSO only in the Enterprise plan, priced on request.
Production takes Redis and two processes on top of PostgreSQL. PostgreSQL is the only supported database. The deployment guide runs the same app twice, once in server mode (API and admin) and once in worker mode (scheduled jobs, event subscribers), keeps sessions in Redis, and asks for at least 2 GB of RAM. Node.js 22.22.0 has been the minimum since v2.22.0.
The project points newcomers to its own cloud and to AI agents first. The README calls Medusa Cloud the fastest way to get started, and the deployment guide asks readers to consider it before self-hosting. The website brands Medusa an "open-source agentic commerce platform", and the docs open with a prompt that has an AI agent install Medusa and deploy it to Cloud, whose plans start at $29 a month.
Every minor release since August includes a breaking change. v2.22.1 shipped on 23 October 2026, and the latest commit is dated 27 October. The notes for 2.19 through 2.22 each flag at least one, among them the admin's move to Vite 7 and the end of Node.js 20 support. The 2.21 notes add that the team usually doesn't ship patches for older versions.