Set up a payment address

Create an OPID

An Open Payment Address (OPID) is a canonical HTTPS URL people can use to pay you.

What you need

A stable HTTPS URL on a website you control, somewhere to receive payments, and permission to publish a file at the derived record URL. This page does not upload your details.

01 / RECEIVE PAYMENTS

Choose where each payment should go

02 / CHOOSE A DESTINATION

A URL you own, or hosting by us

03 / GO LIVE

Publish the file yourself, or let the app do it

Updating an address you already published?

Load what is published at your OPID and edit it here. The next revision number is worked out for you. Your record is read in this browser and nothing is uploaded.

Paste the record JSON instead

Reading your record over the web needs Access-Control-Allow-Origin: * on your host. If it is not set, download or copy the published file and paste it here.

Configure how people can pay you

Add payment options in preference order. A payer chooses one compatible option; they never combine options. None of this depends on where the file will live.

Name shown to payers (optional)

Payment optionsOffer one or more ways to pay, in your preferred order Another payment addressForward resolution to one other OPID instead

Your ordered options

Put your strongest settlement preference first. You can add up to 16 options.

Where should this live?

Your payment details are the same either way. Only the address they live at, and who publishes it, differ.

Use your own URL/hostingPublish the payment file on your own domain Use our OPID hostingClaim yourname.openpaymentaddress.org and let us host it

Canonical HTTPS OPID people will use to pay you

Use HTTPS. It does not need to point at a webpage. You can use the domain itself or a specific path, such as https://your-domain.org/donate. Do not include a port, query, fragment, or a final slash after a path. The payment file is published separately at the derived record URL shown beside this form.

Revision

Every republish of the same OPID must carry a higher number than the one payers already saw. Loading your published record sets this for you; override it if you are reconciling a record this page could not read.

This page creates the file in your browser. It does not send your payment details to a server.

Live preview

OPAP/1

Payment file being built

No name shown to payers

Canonical HTTPS OPID

https://your-domain.org/donate

Derived record URL

Enter your canonical HTTPS OPID to derive this URL

Revision 1. Payers reject a republish that does not count up.

Check before publishing

Anyone can read this file. Check every bank, token, and wallet detail before you upload it.

Domain and hosting resilience

Keep your OPID online

Your OPID is only as durable as its domain. If resistance to arbitrary suspension and hijacking matters, compare registry rules and security controls—not only price.

.is Iceland

ISNIC's published rules generally require a court decision or a final ruling from a competent body to close a domain as illegal. Foreign registrants are allowed.

Read the official .is rules

.ch Switzerland

SWITCH revokes domains on enforceable Swiss decisions. Some registrars also offer Registry Lock to reduce hijacking and accidental-change risk.

Read the official .ch rules About Registry Lock

Hosting matters too

A .is or .ch OPID can still go offline if its DNS or web host suspends it or fails. The domain ending does not control where its DNS and payment file are hosted.

If Icelandic or Swiss jurisdiction matters to you, verify the hosting company and its abuse and suspension policy—not just the server location.
Avoid one point of failure: keep the registrar, authoritative DNS, and web hosting independently replaceable, and use geographically redundant DNS and hosting.
Keep an offline, deployable copy of the payment file and configuration so you can move hosts without changing the OPID.

Read NIST's resilient DNS guidance

No domain is untouchable

Courts and competent authorities can still order action. Invalid registration details, non-payment, policy breaches, or technical failures can also take a domain offline.

Whichever ending and host you choose: use two-factor authentication, enable auto-renew and DNSSEC, keep ownership details accurate, and add Registry Lock when available.

Your payment file is ready

Publish this file on your website

Download the file and upload it to the exact web address below. This lets payment apps find where to send payments.

Publish it over HTTPS in three steps

1Upload the file to this derived record URL:
2Make it publicly available over HTTPS without a redirect. A static host may serve it as application/json, text/plain or application/octet-stream; application/opap+json and Cache-Control: no-store remain recommended.
3For direct browser access, set Access-Control-Allow-Origin: *. This is a browser capability, not a validity condition; native resolvers and relays can still resolve a record without it.

Recommended security

Add DNSSEC key binding

A signed record creates exact-host key continuity even through insecure DNS. DNSSEC independently strengthens the current key's domain binding.

1. Enable DNSSEC. Activate it at your DNS provider and publish its DS record through your domain registrar.
2. Publish an origin key. Generate an Ed25519 signing key and put only its public key in the DNSSEC-protected TXT record _opap.your-domain as v=opap1;epoch=1;ed25519=<base64url-public-key>;rec=none.
3. Sign the payment file. Sign the exact decoded file bytes. On a configurable host, return OPAP-Proof: v=1;sig=<signature> and expose it with Access-Control-Expose-Headers: OPAP-Proof. On a file-only host, upload the same proof line as a UTF-8 sidecar at:

Never publish or upload the private signing key. This creator makes only the payment file; use OPAP-aware publishing software or hosting to create and manage the key and proof.

If a hosting provider holds this key, it controls publication and every payment target under that hostname. Ask whether the origin key is provider-held or publisher-held. For independent recovery, commit to an offline recovery key instead of rec=none and keep the epoch-0 public key plus exact rec value outside this hostname.

Once you have uploaded it

When the file is publicly available at the address above, your OPID is active as https/none. A valid origin key and header or sidecar proof establish first-use continuity; DNSSEC is shown independently as the stronger binding.

Share this canonical HTTPS OPID with anyone who needs to pay you:

Do a test payment to this OPID →

Payment file

JSON