Loading page
User Management
Each environment gets its own identity realm. Your users register, verify their e-mail, sign in and reset passwords on hosted screens; your application receives a standard OpenID Connect token and Paycux records the identity. Administrative user actions are planned, not available.
Available in part — User Management: One identity realm per environment with hosted registration, verification, sign-in and password reset, read-only user records, and organisations that end users create themselves. Items listed as planned below cannot be enabled yet. What Paycux provides today.
Status
Setup
Open the environment's Authentication tab and save the display name plus the exact redirect, logout and checkout-return URLs. The status moves from pending to ready once the realm has been provisioned.
Start an authorization code flow with PKCE against the issuer and client ID shown in the console. Registration, verification, sign-in and reset happen on the hosted screens.
Call GET /v1/identity/me, report usage or create organisations with the realm access token. The identity record is created on first use and listed in the console.
Isolation
Development, staging and production each get their own realm, issuer and user pool. A token from one realm is never accepted for another environment, and the API only trusts issuers it provisioned itself.
Teams
Two separate membership models exist today. End users group themselves into organisations through the API. Your own colleagues join the Paycux console as workspace members with a role.
What exists
Everything below can be used from the console or the API today. The last item lists what is planned and not part of the product yet.
HTTP
Console routes use the dashboard session cookie. End-user routes use the realm access token. There is no SDK; every call is plain HTTP.
1curl "https://api.paycux.com/v1/environments/<environment id>/auth?projectId=<project id>" \2 --cookie "__Host-paycux_session=<session cookie>"34HTTP 2005{6 "setup": {7 "workspaceId": "<workspace id>",8 "projectId": "<project id>",9 "environmentId": "<environment id>",10 "realmId": "<realm id>",11 "providerRealmName": "pcx-<uuid>",12 "displayName": "Example App",13 "redirectUris": ["https://app.example.com/auth/callback"],14 "logoutRedirectUris": ["https://app.example.com/"],15 "checkoutReturnUrls": [16 "https://app.example.com/billing/cancel",17 "https://app.example.com/billing/done"18 ],19 "status": "ready",20 "revision": 2,21 "appliedRevision": 2,22 "issuer": "https://<identity host>/realms/pcx-<uuid>",23 "clientId": "<client id>",24 "discoveryUrl": "https://<identity host>/realms/pcx-<uuid>/.well-known/openid-configuration",25 "lastErrorCode": null26 }27}
Transparent pricing
In part No separate price for what works today.Workspace plans
Included in every workspace plan. Limits (projects, provider connections, members, usage events) are listed on the pricing page.
Questions
No. Registration, sign-in and password reset happen on the realm's hosted screens. Direct password grants are disabled on the client, and the Paycux API only ever sees the resulting access token.
Not yet. User records are read-only today: e-mail, verification state, subject and first access. Administrative actions and profile updates through the API are planned.
No. Nothing publishes user events yet. Signed provider webhooks exist for billing, but a user events feed is planned and not available.
Not today. The hosted screens are the only way to obtain a token, and e-mail plus password is the only method. Social sign-in, magic links and custom domains are planned.
They are separate. Organisations are created by your application's end users through the API with their realm token. Workspace members are your own colleagues in the Paycux console, with owner, admin, developer, billing or viewer roles.
The console shows the status and explains the last error. Pending means the saved revision has not been applied yet; failed names the cause, such as e-mail delivery not being configured. Saving again retries a failed setup.
Keep exploring
Create a workspace, configure the Authentication tab of an environment and point your application at the issuer it reports.