Payload

Payload is a TypeScript-first CMS and application framework designed to install directly inside an existing Next.js /app directory rather than run as a separate service. A single typed configuration file defines collections, globals, fields, access control, and hooks, and Payload generates a REST API, a GraphQL API, and an in-process “Local API” from that one source of truth, along with automatic TypeScript types for every document shape.

Beyond content modeling, Payload ships auth, versioning and drafts, localization, a block-based layout builder, and a fully customizable React admin panel built with server components. Database access is abstracted behind adapter packages for MongoDB, Postgres, SQLite, Vercel Postgres, and Cloudflare D1, and storage adapters cover S3, GCS, Azure, R2, and Vercel Blob, so the same application code can target different infrastructure with a config change rather than a rewrite.

What You Get

• A typed config file (payload.config.ts) that defines your entire backend: collections, globals, fields, access control, and hooks
• Auto-generated REST, GraphQL, and Local (in-process, no HTTP) APIs from that single config, with generated TypeScript types for every collection and global
• A customizable React admin panel built with server components, extensible with custom fields, views, and components
• Pluggable database adapters (MongoDB, Postgres, SQLite, Vercel Postgres, Cloudflare D1) and storage adapters (S3, GCS, Azure, R2, Vercel Blob)
• Built-in authentication, versioning/drafts, localization, a block-based layout builder, and a Lexical rich text editor
• A create-payload-app CLI with ready-made templates (website, ecommerce) and one-click Vercel/Cloudflare deploy buttons

Common Use Cases

• Building a marketing site or blog with a content-editable admin panel embedded in the same Next.js app that renders it
• Standing up a headless CMS backend for a decoupled frontend, consumed over REST or GraphQL
• Building general-purpose backends/APIs that need auth, access control, and admin CRUD screens, not just content editing
• Running an ecommerce catalog or marketplace using the official ecommerce template and plugin

Under The Hood

Architecture Payload’s core package separates concerns cleanly: collections/, globals/, fields/, auth/, database/, admin/, and config/ each own a distinct concern, and database/createDatabaseAdapter.ts defines a BaseDatabaseAdapter contract that separate adapter packages (db-mongodb, db-postgres, db-sqlite, db-vercel-postgres, db-d1-sqlite) implement independently, keeping the query engine in database/queryValidation and flattenWhereToOperators.ts database-agnostic. Local API operations under collections/operations/local/* sit beneath the REST handlers and the GraphQL resolvers in the companion @payloadcms/graphql and @payloadcms/next packages, so all three surfaces call into the same operation functions instead of duplicating business logic. A sanitizeConfig step in config/sanitize.ts normalizes user-supplied collection/global/field configs into a fully resolved SanitizedConfig before anything else runs, and since fields, hooks, access control, and the admin UI all read from that shape directly, it acts as the framework’s central contract.

Tech Stack TypeScript throughout, published as ESM, built with SWC plus a tsc --emitDeclarationOnly pass and Rollup for bundling declaration files, targeting Node 24.15+. Core dependencies are deliberately narrow for a framework of this scope: commander for the CLI, ajv alongside zod/@standard-schema/spec for schema validation, dataloader for GraphQL batching, pino for structured logging, jose for auth tokens, and qs-esm for query parsing. It is a pnpm/Turborepo monorepo spanning 50+ packages — database adapters, storage adapters (S3/GCS/Azure/R2/Vercel Blob), a Lexical-based rich text editor, and framework integrations (@payloadcms/next, a TanStack Start adapter) — all developed together but published as independent npm packages.

Code Quality Testing is extensive across two layers: colocated *.spec.ts unit/integration tests run under Vitest (dozens inside the core package alone, covering config sanitization, auth cookies, and upload handling), plus a large root-level test/ directory with well over a hundred scenario folders and dozens of Playwright end-to-end suites exercising the admin UI in a real browser. CI runs a dedicated dependency-audit workflow and an AI-assisted review step alongside the standard build/test pipeline. ESLint is enforced repo-wide through a shared internal config package, TypeScript runs in strict mode from a shared base tsconfig, and errors are modeled as typed classes rather than bare strings or unchecked throws.

API Design The framework’s central bet is config-as-code: a full application backend is declared in one typed object, and Payload derives REST, GraphQL, and a fully typed Local API from that single source of truth along with generated TypeScript types for your data — eliminating the usual drift between a hand-written API layer and its types. It installs inside an existing Next.js app rather than requiring a separate server process, and the admin panel is generated from the same config and extensible with custom React server components rather than being a fixed pre-built UI. create-payload-app scaffolds a working project in one command, and one-click deploy buttons for Vercel and Cloudflare Workers remove most of the remaining infrastructure setup.