Sign in with Paymenter | Pterodactyl v2

Let customers sign in to your Pterodactyl 2.0 panel with their Paymenter account. Sign in with Paymenter adds a button below the login form. A customer clicks it, signs in to your Paymenter store if they are not signed in already, clicks Authorize on Paymenter's page, and is in their own panel account. No second password to remember.

Free and open source (MIT).

What it does

• A "Sign in with Paymenter" button on the login page, with your own label if you like. It only appears once the extension is set up.
• Uses Paymenter's built-in OAuth server (Admin → OAuth Clients): no Paymenter extension to install.
• Finds the right account. The first time, the panel account with the same email address, only if Paymenter has verified that address. After that, the customer's Paymenter account itself, so changing the email address in Paymenter does not lock anyone out.
• Refuses clearly. No panel account with that address, an unverified address, or an administrator: the login page says why. It never creates accounts.
• Keeps two-factor authentication. Accounts with 2FA get the panel's own checkpoint after Paymenter.
• Administrators stay on passwords unless you allow them (off by default).
• Back where they were going: a customer sent to the login page from a server page lands on that server.

Screenshots: A Sign in with Paymenter button on your login page · Customers approve in your Paymenter, then land in their account · One OAuth client, a few settings, the secret stays encrypted · Clear messages; administrators keep their passwords · Two-factor authentication still applies.

Security

• OAuth 2.0 authorization code flow with state (single use, 10 minutes, bound to the browser's session) and PKCE (S256).
• The exact redirect URL is fixed by your panel's address and checked by Paymenter.
• Starting a sign-in needs the panel's CSRF token; the steps share the panel's sign-in rate limit (10 per minute per IP).
• The session is made by the panel's own login code: new session id, the usual activity entries, 2FA.
• Every sign-in and refusal is written to the panel's activity log.
• The client secret is stored encrypted, shown only as a mask and never sent to a browser. Paymenter's access token is used once and not stored.
• HTTPS to Paymenter is required (http only for localhost); requests time out after 10 seconds and do not follow redirects.

Compatibility

Tested with Pterodactyl 2.0.0-beta.2 (PHP 8.4) and Paymenter 1.5.9. Paymenter has to be reachable from the panel server at the same address customers use. Matching by email needs verified addresses in Paymenter (its verification email, or an admin's "Email Verified" switch). Does not run on Pterodactyl 1.x.

Install

1. php artisan p:extension:install paymenter-sso.pteroext --enable
2. chown -R www-data:www-data extensions public/assets/extensions (your web server's user)
3. In Paymenter: Admin → Other → OAuth Clients → New. Redirect: https://your-panel/extensions/paymenter-sso/callback. Copy the client secret and the client ID.
4. In the panel: Admin → Extensions → Sign in with Paymenter → Settings: Paymenter URL, client ID, client secret.

The README in the download covers every setting, how customers are matched, troubleshooting and uninstalling.

FAQ

Do I need Karelia Bridge or another Paymenter extension? No. This works with Paymenter's own OAuth clients and any way you create panel accounts (Paymenter's Pterodactyl server extension creates them with the customer's email).

Why does Paymenter show its Authorize page every time? Without it, a customer who had to sign in to Paymenter first would be left on Paymenter's login page (Paymenter 1.5.9 loads the next page with JavaScript, which browsers do not let follow the redirect back to the panel). One click keeps it reliable.

Can it be used with Pterodactyl's official SSO extension? Yes, both can be installed; both sets of buttons show. This is a separate extension because the official one has no administrator protection, rate limit or activity entries for providers, and a provider would have to be copied into it after every update.

Does it create panel accounts? No. Customers without a panel account get a clear message.

Support

Use the support link on this page. Please include your panel and Paymenter versions and the message the login page showed.

Not affiliated with Pterodactyl or Paymenter.

Want customers to open a server from Paymenter in one click, with billing in the panel? See Karelia Bridge.