Telegram sales are the reason to choose SpiderPanel
Approve a payment receipt in Telegram, and SpiderPanel can deliver the customer's proxy subscription and QR code. That is its clearest selling point. The panel joins Xray account administration to the work of selling access: plans have their own price, traffic allowance and expiry. If you currently copy account details between a proxy dashboard and Telegram conversations, this is a plausible replacement for that routine.
Our checkout contained 28 files and roughly 21,051 lines of source, so the small file count hides a substantial application. FastAPI handles accounts, subscription pages, node management and scanners. The interface defaults to Persian, with an English language toggle, and the README includes English documentation. English-speaking operators can assess it without translating the instructions, though they should try the interface before committing their support workflow to it.
What happened when we ran it
Our sandbox installed SpiderPanel commit e20c384 in 363 seconds, adding 35 packages and using 38 MB on disk. The build succeeded in 1 second. We ran it on October 14, 2026, in an unprivileged Debian container with 3 CPUs, 8 GB of RAM and no secrets, using the ghcr.io/astral-sh/uv:python3.12-bookworm image. Installation and build both completed successfully.
Pip-audit reported 0 known vulnerabilities. Tests were skipped because the repository had no test script or target, and the scan found no tests directory or CI workflow files. A Dockerfile was present. The checkout occupied 8.5 MB before installation. These measurements establish that the dependency and build steps worked in that environment. They do not establish working subscriptions, successful Telegram delivery, proxy throughput or reliable account expiration.
Direct launches need credentials the VPS installer generates
The authentication code at e20c384 reads ADMIN_PASSWORD and falls back to admin when it is absent. SECRET_KEY also has a fixed fallback. The VPS installer generates credentials, so that criticism belongs specifically to an unconfigured direct launch, including the README's local Uvicorn example. Set both values before making that route public. A stored password hash can override the initial password on subsequent starts.
The 0-known-vulnerability audit result does not assess those application defaults. SpiderPanel's own security notes call for HTTPS and restricted administrator access. Its Dockerfile uses Python 3.13 and builds Telegram's MTProxy binary, whereas our sandbox used Python 3.12. The successful sandbox build therefore leaves the documented container deployment unverified. Treat the installer, local Python route and Docker image as different deployment paths when deciding what evidence you still need.
Subscription links depend on a stable public domain and storage
SpiderPanel listens on port 8080 and deliberately ignores a provider-supplied PORT value. Railway or your reverse proxy must route traffic accordingly. The deployment and Web Proxy documentation explains how the public hostname feeds subscription links and the built-in Telegram Web Proxy. That proxy shares the panel's public HTTPS and WebSocket endpoint, so exposing a dashboard successfully is only part of configuring usable customer links.
The 38 MB installed environment excludes the operational problem of preserving customer state. DATA_DIR defaults to /data, where the application stores its state and the fallback Web Proxy signing key. The README warns that ephemeral storage invalidates existing Web Proxy links, and replicas must share SPIDER_TWP_SIGNING_KEY. That rules out a disposable deployment with no persistent volume. Back up the state and check that an existing customer's link survives a restart before accepting payments.
Receipt approval remains manual, and imports have an open report
The Sell Bot asks customers to upload a receipt for administrator approval. It can associate accounts with numeric Telegram IDs, update existing accounts and separate activation from message delivery. Those are useful provisions for an operator handling renewals. They don't turn the documented purchase flow into automatic payment verification. Someone still has to decide whether a receipt deserves approval, and customers still need help when a delivered configuration fails.
Our 363-second installation cannot answer those delivery questions. Issue 3's subscription-import report includes connection timeouts followed by invalid subscription content. Issue 10's connectivity report says generated configurations do not ping on the reporter's mobile network. Both remain open. Neither establishes a universal defect or its cause, but they justify checking a real client on the network your customers use before moving existing accounts.
Recent pushes show activity; licensing remains unclear
The repository's last push was October 13, 2026. GitHub listed 1,941 stars and 3 open issues and PRs; the fetched discussion list identified all three open items as issues, with updates on October 11. One concerns forking rather than proxy behavior. The latest-release endpoint returned no published release. Taken together, the push and discussion dates show recent activity, while the missing release leaves operators without a published release to select.
Our scan found 0 CI workflow files, which limits the visible automated checks supporting that activity. GitHub also reported no detected license, and the inspected tree contained no LICENSE file. Organizations requiring an explicit open-source license should resolve that before adoption. A public repository and a successful build are insufficient grounds to assume the project's licensing terms. Pinning e20c384 preserves the reviewed snapshot, but it doesn't resolve either concern.
Choose a narrower panel if Telegram sales add no value
Marzban is a direct alternative for Xray user administration. 3x-ui suits operators choosing around protocol and inbound controls, while wg-easy fits a simpler WireGuard VPN requirement. SpiderPanel earns a trial when receipt approval and subscription delivery are work you actually do. Before transferring paying customers, approve a sample order, import its subscription on the intended network, and confirm that expiry removes the account as expected.