How to Sell Access to a Private GitHub Repo: Every Option Compared (2026)

Which platform you pick matters less than three GitHub rules most sellers learn after their first refund: forks are deleted when you remove a collaborator, clones are not; invitations expire in seven days; on a paid organization plan every buyer is a seat.

Once you know them, the whole market of tools for selling repo access sorts itself into five shapes. I compared all of them, priced them at twenty sales a month, and wrote down which one to pick for which kind of seller. One of the self-hosted tools is mine, and I say so where it comes up.

How selling access to a private GitHub repo works, whatever tool you use

Every option in this guide does the same four things. It takes money, learns the buyer’s GitHub identity, calls one GitHub API endpoint to invite that identity to a repository or a team, and later, on a refund, a chargeback or a lapsed subscription, calls another endpoint to take the invite back.

The differences are who is the merchant of record, where the code that does it runs, how the buyer’s username reaches you, and what happens in the seven days between the invite and the click.

TL;DR

• Sell from a GitHub Free organization: unlimited private repos and collaborators at no cost. On GitHub Team every buyer is a $4 seat.
• Revocation stops future updates. Forks are deleted, clones stay, so price the code, not the ability to take it back.
• Zero operations: Polar or Dodo Payments, 4 to 5% plus 40 to 50 cents per sale, and they handle tax as merchant of record.
• Own the pipe on Stripe: RepoAccess core (free, AGPL) or Honorbox. On Paddle, Lemon Squeezy, Gumroad, Razorpay or Telegram Stars: RepoAccess Pro.
• Every “free” script has a bill somewhere: Vercel Pro, a Zapier plan, a Rails host, or your evenings re-sending expired invites.

What you are actually selling: the next commit, never the code you already shipped

GitHub says it in one sentence on the page about removing an outside collaborator: “While forks of private repositories are deleted when a collaborator is removed, the person will still retain any local clones of your repository.” The next sentence hands you the rest of the job: you are responsible for making sure people who lost access delete what they copied. A git clone takes ten seconds, and no revocation can see it.

So the only thing a refund can take back is the future: the next tag, the fixed bug, the private issue tracker, the discussions with other buyers. Sellers who have been through a refund price accordingly.

MakerKit’s FAQ reads “Due to the non-returnable nature of this product, we generally cannot offer refunds once access is redeemed”, and Jumpstart Pro uses the same wording for its yearly plans. The exception I found is SaaS Pegasus, seven days and no questions asked, and it ships a generated download rather than a repo. A refund window is cheap when the product is a snapshot.

That reframes the whole comparison. Revocation is not a security feature, it is a subscription feature. Its job is to keep a lapsed subscriber or a charged-back card away from the next release and to stop your collaborator list from turning into a graveyard.

Judge every tool below by how reliably it does that boring job, and ignore anything that promises to protect your code. Nothing does.

Two pricing consequences follow. With one-time access and lifetime updates, a refund costs you one download and the buyer gains little by asking, so a generous refund policy costs less than it looks. With yearly access, revocation is what makes the renewal real: a tool that cannot revoke is selling lifetime access at a yearly price, whatever the checkout page says.

The GitHub rules that decide everything before you pick a tool

Four rules, all in GitHub’s own documentation, sort the market. Most tools assume one answer to each and never say so. Read these first and half the comparison table below becomes obvious.

Personal account or organization: where the seat bill comes from

A repo under your personal account can take unlimited collaborators on GitHub Free, per the docs: “If you’re using GitHub Free, you can add unlimited collaborators on public and private repositories.” That is the cheapest possible setup and also the most limited one. Personal repos have no teams, several platforms refuse them (Polar and GitHub Sponsors both require an organization), and the permission model is coarser than on an organization.

An organization on GitHub Free is the shape I recommend to every seller. GitHub’s pricing page lists unlimited private repositories at $0, and the outside collaborator docs spell out the catch that only bites paid plans: “Unless you are on a free plan, adding an outside collaborator to a private repository will use one of your paid licenses.”

On GitHub Team, at $4 per user per month for the first year, the license reference counts as a seat every organization member, every “outside collaborator on private repositories owned by your organization”, and “anyone with a pending invitation to become an outside collaborator on private repositories”.

Three hundred buyers on a Team organization is a $1,200 monthly bill that grows with every sale and, per the removal docs, “the paid license count does not automatically downgrade” when you remove someone.

If your company org is on Team for other reasons, create a second organization on Free for the products you sell. It takes two minutes and it is the single biggest cost decision in this article.

The checklist for that second organization:

• Create it on the Free plan and leave it there; do not add it to an enterprise account.
• Turn off forking of private repositories in the organization settings (new organizations default to off, check anyway).
• Make the selling account an owner, and keep your day-to-day account out of it or as a plain member.
• Create one team per product and give the team read access to that product’s repos.
• Create a fine-grained token scoped to this organization only, with the one permission the tool you pick needs (next section).

Collaborator invite or team membership: two API calls, two different products

The first way to grant access is a repository collaborator: PUT /repos/{owner}/{repo}/collaborators/{username} with permission: "pull". It is per repo, it works on personal and organization repos, and it comes with a documented cap in the collaborators API: “You are limited to sending 50 invitations to a repository per 24 hour period.”

The default permission on that endpoint is push, so a script that forgets the parameter hands every buyer write access. Honorbox, Pay2Clone, Lemonrepo, SellRepo, Polar, Dodo Payments, GitHub Sponsors, BuyMyRepo, GitPaywall and every tutorial script I read use this call.

The second way is organization membership through a team: the buyer is invited to the organization and placed in the team that holds the product’s repos. One team is one product, a buyer of two products sits in two teams, and access to every repo in the team follows automatically, including repos you add later.

The limit here is the organization invitation cap: “you can only create 50 organization invitations within a 24-hour period. If your organization is more than one month old or on a paid plan, the limit is 500”. Age the organization before a launch.

RepoAccess uses this path, and so does the Gumroad plus Zapier no-code recipe.

You cannot mix them. The outside collaborator docs are blunt: “Outside collaborators cannot be added to a team, team membership is restricted to members of the organization.” So the choice is made once, when you pick the tool, and it decides which token permission you mint: repository Administration: write for collaborators, organization Members: write for teams.

Both are more power than a read-only invite deserves, and both live wherever the tool runs.

Seven days, one inbox, no pending page: the life of an invitation

Every path above ends the same way: GitHub emails the buyer and nothing happens until they click. The invitation “expires automatically” after seven days, per the docs. It goes to the buyer’s GitHub primary email, which is why MakerKit’s troubleshooting page has to tell buyers that “GitHub sends repository invitations to your primary email address associated with your GitHub account, not the email you used for your Makerkit purchase”.

And there is no page on GitHub where a buyer can see invitations waiting for them: the community thread asking for one was opened in 2018, got a “logged internally” from staff the same year, and its latest reply in June 2025 is “2025 guys”.

The timeline you are running, whether you know it or not:

• Hour 0: payment, invite sent to an inbox you do not control.
• Day 1 to 6: the buyer opens the email, or the email is in a spam folder, or the primary address is an old university account.
• Day 7: the invite expires. The repo URL now returns 404 for the buyer, which reads as “I paid and got nothing”.
• Day 8: support ticket. You cancel the stale invite by hand and send a new one, and on a Team plan the pending invite was a seat the whole time.

Only one tool I found treats this as its problem. Honorbox’s docs state the rule and the fix: GitHub “expires an unaccepted invitation after seven days, so it re-issues before that happens”, at day six, up to three times, reading GitHub’s own expired flag rather than trusting the calendar.

Polar had an “invitation is invalid” bug reported in September 2025. RepoAccess, my own tool, documents where to find pending invitations and how to re-invite, and does not re-issue them automatically; that is a gap I am listing here rather than hiding.

Every other tool and every tutorial script is silent, which means the seller is the retry mechanism.

Refunds, chargebacks and what revocation can actually do

Revocation is one more API call: remove the collaborator, or remove the buyer from the team and, if they hold no other product, from the organization. The collaborators endpoint also “cancels any outstanding invitations sent by the collaborator” and deletes the buyer’s fork of a private repo. What it cannot do is reach a clone, so the section above applies: you are stopping updates, nothing else.

The event that should trigger it is where the tools differ most. A refund you issue is easy; your provider emits an event and you know it is coming. A chargeback is the buyer’s bank reversing the charge without asking you, days or weeks later, and it costs a dispute fee on top of the lost sale ($15 at Stripe and Polar, $30 at Dodo Payments).

Of everything I compared, Polar, Dodo Payments, Pay2Clone, RepoAccess and, on subscription lapses, SellRepo revoke without a human in the loop. Only RepoAccess documents a separate path for the dispute event, revoking when charge.dispute.created arrives and never auto-restoring if you later win.

Honorbox core revokes from a command you run after the refund, GitHub Sponsors has no refund tooling at all, and the Gumroad, Lemon Squeezy and Zapier recipes leave it as an exercise.

Whichever tool you choose, the test to run before you trust it is a refund in test mode followed by a look at the organization’s people page. If the buyer is still there, the tool is a granting tool, and the revoking is you.

The payment question: which country you are in, who is merchant of record, and who is still around next year

The delivery half of this problem is four API calls. The payment half is where sellers actually get stuck, and it splits on one fact before any feature matters.

Stripe’s 46 countries decide the first branch

Stripe’s availability page lists 46 countries with full support, India and Indonesia in preview, and five African countries through Paystack. Ukraine, Pakistan, Bangladesh, Turkey, Vietnam, Egypt and Argentina are not on it at all. If you sell from one of those, every “just use Stripe Payment Links and a webhook” tutorial is written for somebody else.

That is not a small group. It is most of the developers on the boilerplate marketplaces, and it is why a merchant of record is a survival choice for them rather than a convenience. For a seller inside the 46, the same choice is a trade: two to three extra points per sale against doing your own tax work.

Merchant of record versus your own processor: what the extra points buy

A merchant of record sells the product to the buyer in its own name, so VAT, GST and US sales tax are its problem, along with invoices and a share of the dispute handling. Lemon Squeezy’s pricing page puts it in one sentence: “We take on tax collection and calculation liability across all jurisdictions.” Paddle, Polar, Dodo Payments and Gumroad make the same promise at different prices.

With your own Stripe account, or with GitHub Sponsors, you are the seller of record. GitHub’s tax page for Sponsors says it plainly: “Sponsored developers are responsible for evaluating and paying their own taxes”, and “in most countries around the world, sales tax for digital transactions is based on the location of the recipient, not on the seller”.

Selling a $99 repo to buyers in thirty countries means thirty tax regimes, an OSS registration if you are in the EU, and an accountant who understands digital goods. I went through that arithmetic for my own products in the Paddle write-up.

The rule of thumb I use: under a few hundred sales a year, the MoR fee is cheaper than the accountant. Above that, and inside the 46 countries, owning the Stripe account starts to pay, provided the delivery tool you pick does not take a cut of its own.

Fee table, September 2026

Base rates from each provider’s pricing page on the day I checked. Surcharges and payout fees are in the next section, because that is where the differences hide.

Two rows deserve a note. Stripe Managed Payments is where Lemon Squeezy is heading: the January 2026 update promises “public access for Stripe Managed Payments” and a migration path for Lemon Squeezy users, with support for “merchants in 35+ countries”, which is fewer than Lemon Squeezy serves today; what that migration means for a repo seller is its own article. And Dodo’s GitHub feature is four months old at the time of writing, so nobody has a year of refunds and edge cases behind it yet.

Platform risk is a line item now

I would not have written this section two years ago. Since then Lemon Squeezy was bought by Stripe and is being folded into a product with a different country list, and its Trustpilot page sits at 1.2 out of 5 across 173 reviews, 88% of them one star, most about rejected stores and withheld payouts. Whop’s page has 2,989 reviews with 29% one star, its score suppressed by Trustpilot for guideline breaches, and an August 2026 review reads “they held our money for 90 days saying its in reserve after the 90 days passed they suspended our account”.

The specialist tools churn faster than the platforms. GitPayments (2023) no longer resolves in DNS, RepoBear (2024) does not answer, the GitCash listing on Gumroad returns 404, and Suparepos redirects to an unrelated subscription bundle. None of these had an export button.

The practical consequence is the portability test: if this provider closed my account on Friday, could I be selling through another one on Monday without re-inviting every buyer? A tool that stores the grant records on your side and speaks to more than one provider passes. A platform where the buyer list, the checkout and the GitHub grants all live in one account fails, whatever its fee.

The costs nobody lists on the pricing page

Every option above has a headline number and a second number. This section is the second number, collected from the pricing pages of the tools around the tool.

Automation subscriptions: Zapier, Make, n8n

The no-code recipe is a Gumroad or Lemon Squeezy sale trigger followed by a GitHub invite. On Zapier’s pricing page the Free plan is 100 tasks a month, “two-step Zap workflows” only, polled every 15 minutes. A sale-then-webhook Zap fits, so the first hundred sales a month cost nothing.

Then reality arrives. A Formatter step to strip the ”@” a buyer typed in front of their username is a third step, a second Zap for the refund trigger is more tasks, and 2-minute polling is on Professional, from $19.99 a month.

Make is 1,000 credits and two active scenarios on Free, then $12 a month for Core with 1-minute scheduling. n8n is free self-hosted and 20 EUR a month on its cheapest cloud plan.

None of that is expensive. It is just never in the “free” tutorial, and it is a monthly line for what is, underneath, one HTTP request.

Hosting for the “free” scripts: Vercel’s rule, a Rails host, Cloudflare’s free plan

The $7 and $20 Next.js scripts, and the MakerKit tutorials they descend from, deploy to Vercel with one click. Vercel’s Hobby plan docs say the plan “restricts users to non-commercial, personal use only”. A paywall in front of a product you sell is commercial use, so the real price of a “free” script is Vercel Pro at $20 per user per month, or a policy violation waiting for a busy launch day.

A Rails storefront like SellRepo needs a host. Render’s cheapest paid web service is $7 a month; its free tier is described as for exploring and personal projects, and it spins down. Fly, Hatchbox and a VPS land in the same range once you add a persistent disk for SQLite.

Cloudflare is the one place where the free plan means it for this workload. Workflows are on the Workers Free plan with 3,000 steps a day, SQLite-backed Durable Objects have been on it since April 2025, and Workers KV allows 1,000 writes a day.

A sale is a handful of steps and a few writes, so RepoAccess, Pay2Clone and Honorbox’s webhook relay all run at $0 until the Paid plan’s $5 a month becomes worth it for the headroom. The launch article has the per-sale arithmetic against those limits.

Honorbox’s default mode runs on GitHub Actions instead, polling Stripe twice an hour from a private repo. GitHub Free includes 2,000 Actions minutes a month for private repos, and a poll every 30 minutes is about 1,440 runs, so the budget holds as long as each run finishes in about a minute. The price of that $0 is delivery latency: 15 minutes median by the project’s own docs, versus seconds for a webhook.

Surcharges behind the headline rate: international cards, refunds, disputes, payouts

Stripe adds 1.5% for international cards and 1% for currency conversion, charges $15 per dispute, and keeps the processing fee when you refund. Standard payouts are free; instant ones cost 1.5%. Every MoR built on Stripe inherits a version of this and adds its own layer.

Polar adds 1.5% for international cards, $15 per dispute, $2 a month of active payouts plus 0.25% and 25¢ per payout, and 0.25% to 1% for currency conversion.

Dodo Payments adds 1.5% international, 0.5% on subscriptions, $30 per dispute and $25 per USD SWIFT payout. Lemon Squeezy adds 1.5% international, 1.5% for PayPal, 0.5% on subscriptions, 1% per payout to a non-US bank and 3% capped at $30 per PayPal payout outside the US. Paddle’s page lists none of these separately; its 5% + 50¢ is presented as all-inclusive.

For a seller outside the US with buyers outside the US, which describes most of the people this article is for, the effective rate of a “5% + 50¢” MoR is closer to 7% to 8% before the first dispute.

The GitHub seat bill, the tax work and your evenings

The seat rule from the section above is the largest hidden cost on this list and the easiest to avoid: on GitHub Team every buyer and every pending invite is $4 a month, on a Free organization it is $0. The tax work is the second largest and the hardest to price: an MoR charges roughly 2 to 3 points to make it disappear, and every path where you are the seller of record hands it back to you.

The third is time. Expired invites, mistyped usernames, refunds you revoke by hand, a fine-grained token that expires in a year (SellRepo’s docs suggest 90 days or a year; RepoAccess documents the rotation because the token cannot be made permanent), and a Zapier task quota you find out about when it runs out. None of these is money on a pricing page, and all of them are why sellers with fifty buyers go looking for a tool.

Worked example: twenty sales a month at $99

Assumptions: 20 one-time sales at $99 ($1,980 gross), 7 of them on international cards, one refund a month, one dispute a quarter, a seller inside the Stripe countries with a US bank. Numbers are rounded from the pricing pages linked above; your mix will differ, so redo the arithmetic with your own before deciding.

The spread between the cheapest and the most expensive path is about $140 a month on $1,980 of sales, which is real money and also not the decision.

The decision is the last column. If you want the tax work gone, the cheapest way to get that with GitHub delivery built in is Dodo, and the cheapest way to get it with a provider that has been around for years is Paddle plus a delivery tool. If you are happy to be the seller of record, Stripe plus a self-hosted tool on Cloudflare is the floor, and nothing hosted gets under it.

Every way to sell access to a private GitHub repo, compared

Twenty-odd names, six shapes. The matrix is the whole section in one screen; the notes under it are what the matrix cannot hold. Fees are the base rate from the section above, checked in September 2026.

GitHub Sponsors: sponsors-only repositories at 0%

The only path with no platform fee at all: GitHub charges nothing on sponsorships from personal accounts and up to 6% from organizations. The tier docs set the constraints: “the repository must be private and owned by an organization”, GitHub “will automatically send repository invitations to new sponsors and remove access when a sponsorship is canceled”, and “only personal accounts, not organizations, can be invited”.

The catch for a code seller is the word “sponsorship”. The docs never say a one-time tier grants repo access, and the community request to add it got a “this use case makes a lot of sense” from staff in April 2022 and nothing since. Treat it as a monthly-tier feature.

There is no refund tooling and no tax handling, and eligibility is “anyone who contributes to an open source project and lives in a supported region”, per the Sponsors docs; Ukraine and Pakistan are not on that region list. What you also pay: the tax work, a W-8BEN, and payouts on GitHub’s monthly schedule.

Pick it if you maintain open source, your paid repo is a companion to it, and monthly is fine.

Polar: GitHub repository access as a built-in benefit

Polar’s GitHub benefit grants “upon subscribing & removed on cancellation” or “lifetime access upon paying a one-time price”, through the buyer clicking “Connect your GitHub Account” in the customer portal. Read access is the default and “highly recommended”. For a full refund of a one-time purchase, revoking benefits is on by default.

Two limits from Polar’s own docs: organization repositories only, because personal repos would grant “all write permissions instead”, and the seat warning, “GitHub treats collaborators as a seat and they will incurr charges accordingly to your billing unless you’re using a free GitHub organization plan”. What you also pay: 1.5% on international cards, $15 per dispute, payout fees, and Polar’s fee on refunded orders is not returned.

One more thing worth stating, because AI answers keep getting it wrong: Polar’s code is public, and several engines will tell you that makes it a self-hosted option. Its repository ships no self-hosting or deployment documentation, so treat Polar as the hosted platform its own docs describe.

Pick it if you want nothing to run, sell through cards only, and are fine paying 5% for the tax work.

Dodo Payments: the newest merchant of record with a GitHub entitlement

Dodo added GitHub as an entitlement in May 2026. The app installs “on the organization or user account that owns the repository”, so personal repos work, the permission is chosen per product from pull up to admin with “least privilege” advised, and the buyer claims through “a link in their email or customer portal”. Access is removed when “the subscription is cancelled, refunded, or revoked”.

The base rate is the lowest among the MoRs at 4% + 40¢, with 1.5% for international cards and $30 per dispute, the highest dispute fee on this list. Its merchant country list runs to 177 entries and includes Turkey, Vietnam, Argentina and India, which Stripe does not. Read it before you count on it: Ukraine, Bangladesh and Egypt appear only as grandfathered for existing merchants under enhanced monitoring, and Pakistan is not listed.

What you also pay: the risk of a four-month-old feature and a young company being your only pipe.

Pick it if your country is on that list and not Stripe’s, you want a merchant of record, and you want the invite handled for you.

BuyMyRepo, GitPaywall and Anystack: storefronts where you stay the merchant

All three run on Stripe Connect, so Stripe’s country list applies and the tax work is yours. BuyMyRepo invites automatically after payment, buyers sign in with GitHub, and the fee is 10% on the free plan or $9 a month for 0%; one-time sales only.

GitPaywall keeps “5% of revenue from one-time code payments”, invites through a GitHub App the moment a buyer “or AI agent clears the wall”, and has no monthly plan. Anystack is a licensing platform with an “Unlock” feature that manages invites and revokes “once a license expires, or when you suspend a license”; its fee runs from 15% on the free plan down to 4% at $149 a month, and “you are the merchant of record”.

None of the three states what happens to access after a refund on its public pages, and none has a track record I could find outside its own site. What you also pay: the portability test from the previous section; the buyer list and the grants live on their side.

Pick one if you want a hosted storefront in an afternoon, sell one-time, and accept the platform risk.

gitbuyer: crypto checkout, tarballs instead of invites

gitbuyer is the one product here that never invites anyone. The buyer, human or AI agent, pays in USDC on Base or Solana through x402, and “the complete clone arrives as tar.gz”; gitbuyer keeps 10%, “all sales final once delivered”, and settlement runs after delivery so a failed delivery is never charged. No updates, no revocation, no GitHub seat, and no card network.

Pick it if your buyers are agents or crypto-native and the product is a snapshot, not a subscription to updates.

Gumroad, Lemon Squeezy, Whop, Patreon, Ko-fi and Buy Me a Coffee: no GitHub feature, bring a script

None of the general platforms ships a GitHub integration. Gumroad and Lemon Squeezy are the ones sellers actually use for code, because both are merchants of record and both expose the webhooks a script needs; the fee gap is large, 10% + 50¢ against 5% + 50¢. Lemon Squeezy’s future is Stripe Managed Payments, covered above.

Whop charges 2.7% + 30¢ processing, 2% more if it collects tax for you, $15 per dispute and $23 per wire payout, and has no GitHub app I could find in its store or docs. Patreon takes 10% from creators who joined after August 2025.

Ko-fi “is not the merchant of record on any transaction” and “does not collect and remit sales tax or VAT”. Buy Me a Coffee takes 5% plus Stripe’s rate.

Pick Gumroad or Lemon Squeezy if your audience already buys there and you will run the delivery script yourself or through RepoAccess Pro. Skip the other four for code unless the community, not the repo, is the product.

Zapier, Make and n8n: the no-code invite and its missing action

The recipe is a sale trigger followed by a GitHub invite, and it has a hole. Zapier’s GitHub integration lists 22 actions, from Create Issue to Check Organization Membership, and not one of them adds a collaborator, invites to an organization or adds to a team. So the last step is always a Webhooks by Zapier request to the GitHub API with your token pasted into the header, which is the same thing a script does, minus the version control.

The dev.to guide that popularised the Gumroad plus Zapier version never names the action, never explains how the username is collected, and handles removal by hand.

n8n has an “invite a user to an organization” node and can be self-hosted for free. Make’s visible GitHub modules show no collaborator step either. What you also pay: the plan the moment you need a third step, and a token sitting in a SaaS you do not control.

Pick it if you already live in Zapier, sell fewer than a hundred copies a month, and will build the refund workflow too.

Self-hosted tools: own the pipe, choose your ceiling

Five tools and a shelf of scripts run on your account with no cut per sale. They differ on the four things that matter after launch: which providers they speak, whether they revoke, whether they renew a dying invite, and whether anyone maintains them. That comparison gets its own section next.

Skipping repo access entirely: generators, zips and license keys

Some of the best-selling code products never touch the collaborator endpoint. SaaS Pegasus generates a project and hands over a download, which is how it can afford a seven-day refund. Shipixen sells a 1-year or lifetime license to a generator.

A zip behind a license key has no invite to expire, no seat to pay for, and no 50-a-day cap, and the buyer gets no updates unless you build a channel for them.

Pick it if updates are not the product. If they are, you are back to the invite, and the rest of this article applies.

Self-hosted tools head to head: Honorbox, Pay2Clone, SellRepo, Lemonrepo, RepoAccess and the scripts

Everything in this table runs on your account. Facts are from each project’s repository or public pages on September 7, 2026; “last activity” is the last push or release I could see.

Honorbox: Stripe only, GitHub Actions, and the one tool that renews invites

Honorbox is a static storefront on GitHub Pages plus a scheduled GitHub Action that “polls Stripe, invites each buyer’s” account as a collaborator, with “no webhooks required, no database, no server to babysit”. The buyer’s username comes from a custom field on a Stripe Payment Link, and the project refuses ambiguous fields rather than guessing. It is MIT, created in July 2026, and pushed to the day I checked.

Its distinguishing feature is the invite renewal from the section above, and its distinguishing cost is latency: the docs quote “an invite a median of ~15 minutes after payment, sometimes hours when GitHub’s cron drifts”, with a 140-line Cloudflare Worker relay as the opt-in fix. Revocation in the free core is a command you run after a refund; automatic revocation is part of Pro, sold at $29, $99 or $249 one-time. Stripe only, and the README says so up front.

Pick it if you are on Stripe, want zero infrastructure beyond GitHub, and can live with minutes rather than seconds.

Pay2Clone: five providers, GitHub OAuth, proprietary source

Pay2Clone is “self-hosted on Cloudflare” with “one deployment for every repo you sell”, speaks Stripe, Creem, Waffo, Clink and Dodo Payments, and has the buyer sign in with GitHub before the invite, which removes the typo problem entirely. Access is a desired state: “a daily pass reconciles what GitHub actually shows against what your database says”, and “replay it ten times and you still get one order”.

It costs $29 one-time for 12 months of repository access and updates, after which “you keep every version you received”. It is “not open source” and “not a license to resell or to operate for third-party sellers”; the seller is a company in Guangzhou. I found no public repository, changelog or third-party write-up, so the maintenance signal is the copyright year.

Pick it if you want OAuth-grade identity and a Creem or Clink adapter, and you are fine reading closed source before you deploy it.

SellRepo: a Rails storefront from the Jumpstart Pro author

SellRepo is Chris Oliver’s Rails 8.1 application: customer accounts, products with seat counts, licenses, invoices, announcements, and a portal where the buyer types GitHub usernames up to the seat limit. Payments go through the Pay gem to Stripe or, in beta, Lemon Squeezy. The GitHub token wants “Administration: Read & Write”, and the docs recommend a 90-day or one-year expiry with rotation.

What I read in the code: a subscription that goes paused, unpaid or canceled archives the license and removes every username from the repo; a one-time refund does not, because nothing handles it. There is no LICENSE file, so it is source-available rather than open source, and it needs a host. Last push was August 31, 2026, with 181 commits behind it.

Pick it if you want a full storefront with seats and invoices, run Rails happily, and sell subscriptions rather than one-time.

Lemonrepo: the Lemon Squeezy template, quiet since mid-2025

Lemonrepo is the storefront behind supersaas.dev, a Nuxt app deployed on NuxtHub with a Lemon Squeezy license key flow: the buyer pastes the key and a username into an activation form, the app checks the user exists on GitHub, invites them with read, and burns an activation. It has 284 stars and 37 forks, which is more than everything else in this table combined.

It also has no LICENSE file, no revoke path (the webhook handler counts purchases and sends a Telegram message, nothing else), one repo per deployment, and a last push in June 2025 with open issues asking for more providers and more products. Given Lemon Squeezy’s own direction, this is a template to fork and finish, not a tool to run as is.

Pick it if you are on Lemon Squeezy today, want the storefront, and will write the refund handler yourself.

RepoAccess: my tool, team invites on Cloudflare, Stripe free and five more providers in Pro

RepoAccess is one Cloudflare Worker on your account: a webhook arrives, a durable Workflow invites the buyer to the GitHub team that carries the product, and the same Workflow removes them on a refund or a chargeback. The core is AGPL-3.0 and ships the Stripe adapter; buyers type a username at checkout or finish on a one-time claim page, so there is no OAuth app.

A GitHub organization is required, because teams are the unit, and a Free org is fine. I wrote it because my own products ship as repo access and I did not want a platform between me and my Stripe account; the launch write-up covers the architecture.

Where it is stronger than the table above: revocation is a policy you set (auto_revoke or log_only), disputes revoke on charge.dispute.created, retries are idempotent by construction, and one purchase can map to several teams.

Where it is weaker: it does not re-issue an invite before the seven-day expiry, which Honorbox does, and it is three months old with the star count to match. RepoAccess Pro is $129 one-time with a year of updates and adds five adapters: Paddle, Lemon Squeezy and Gumroad, which are merchants of record and handle your tax; Razorpay, which is an Indian payment gateway and is not; and Telegram Stars, which is Telegram’s own rail with no card network in it. That combination is the part of the market no other self-hosted tool covers.

Pick the core if you are on Stripe and want teams and automatic revocation on the free Cloudflare plan. Pick Pro if your checkout is one of those five, or Stripe is not available where you live.

The $7 and $20 scripts and the tutorials: where most sellers actually start

Sell My Repo is a $7 Next.js app for Gumroad that needs a required “GitHub Username” checkout field, a Gumroad license key, a token with “Read and write” on Administration, and a Vercel deploy; its page says “the entire app was built with AI”. GumHub is the $20 older cousin, “a Deploy to Vercel button and filling in five fields”. The tutorials from MakerKit, Brian Briscoe and Dodo Payments are the same forty lines in different frameworks: verify the signature, read the username, PUT the collaborator.

They all work on the day you deploy them. None renews an invite, only the Dodo guide removes a collaborator and only on cancellation, and every one runs on a Vercel plan whose free tier forbids commercial use. They are how you learn the shape of the problem, and the reason the tools above exist.

The same gap opens one level higher. A general self-hosted billing engine such as GetPaidHQ runs on your own infrastructure and plugs into whichever processor you use, which settles the money half completely. The GitHub half is still the forty lines above, because granting repository access is not what a billing engine does.

Pick one if you have ten buyers, one repo, and an evening.

Which one to pick: six questions, each ending in a name

Start at the top and stop at the first answer that is yours.

1. Do you want to run nothing at all? Polar if your repos live in an organization and cards are enough. Dodo Payments if your country is on its list and not on Stripe’s. GitHub Sponsors if the paid repo is a companion to open source you maintain and monthly is fine.
2. Are you inside Stripe’s 46 countries and willing to be the seller of record? RepoAccess core for team-based delivery with automatic revocation, Honorbox if you want collaborator invites with renewal and can wait minutes, SellRepo if you want a storefront with seats. All three cost you Stripe’s rate and nothing else.
3. Do you sell through Paddle, Lemon Squeezy, Gumroad, Razorpay or Telegram Stars, or must you because Stripe is not available to you? RepoAccess Pro is the self-hosted tool with those adapters; Pay2Clone covers Stripe, Creem, Waffo, Clink and Dodo instead. If you would rather not self-host at all, go back to question 1.
4. Is the repo under a personal account and staying there? Dodo Payments, Honorbox, Pay2Clone and the scripts, because they invite collaborators. Polar, Sponsors and RepoAccess need an organization.
5. Are you selling a subscription? Then the tool must revoke on its own: Polar, Dodo, RepoAccess, Pay2Clone, SellRepo. Not Lemonrepo, not a tutorial, not a Zapier flow without its second half.
6. Is the product a snapshot rather than a stream of updates? Ship a zip behind a license key, or use gitbuyer, and skip the invite lifecycle altogether.

Whatever branch you land on, do two things before the first sale: put the repos in a GitHub Free organization, and run a refund in test mode to see whether the buyer is still on the people page afterwards. Those two checks cost nothing and they are where most of the money in this article leaks.

If your answer was question 3, the product page for RepoAccess Pro has the adapter list, the setup wizard, and the price, and the companion articles cover two of the merchants of record in depth: Paddle and Lemon Squeezy on its way to Stripe Managed Payments, plus the one rail with no bank in it, Telegram Stars.