Skip to content
Paycux

Documentation availability

Paycux is in private beta. Most pages describe roadmap or reference material. The implemented boundary is published at docs/API_CONTRACTS.md in the release source and under What exists today in this documentation.

Dashboard

Team authentication

How Team authentication works in Paycux, what it is for, and the smallest setup that gets it running.

Overview

Team authentication is part of the Paycux platform. This page explains what it does, when to reach for it, and the smallest working setup you can ship.

Everything below applies to both environments. Build and test in staging, then promote the same configuration to production without changing your code — only the API key and client ID differ.

Domains

Verify a domain before you let it drive access. Paycux issues a TXT record; once it resolves, the organization owns that domain and users arriving with a matching email address are routed to its connection.

Verification is re-checked periodically. If the record is removed, the domain returns to unverified and routing stops — it does not silently keep working.

Single Sign-On

Single Sign-On is handled by Team authentication rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Directory provisioning

Directory Provisioning keeps your user list in step with the customer's directory. Paycux receives create, update and delete operations and normalizes them into a single shape regardless of the source system.

Deletes arrive as deactivations. Treat a deactivated user as a user who can no longer sign in, and decide separately whether to delete their data.

Paycux MCP

Paycux MCP is handled by Team authentication rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Require multi-factor authentication

Every API request is authenticated with a bearer token in the Authorization header. Keys are scoped to a single environment and are shown once at creation — store them in a secret manager, not in source control.

1curl -X GET 'https://api.paycux.com/v1/organizations' \
2  -H 'Authorization: Bearer $PAYCUX_API_KEY'