AuthKit
The login box you would have built
A hosted, themeable sign-in experience that covers passwords, social, magic links, MFA and enterprise SSO — without a single form of your own.
Add auth to your app in minutes
Out-of-the-box auth flows, live in three steps
Set up your strategies
Choose the authentication methods your app supports — email and password, social providers, magic links, MFA, enterprise SSO. Configurable per organisation, changed without a deploy.
Match your brand
Fine tune the hosted AuthKit UI to fit your app's branding, colours, messaging, and domain. What ships is your login box, not a vendor's.
Redirect and collect the user
Send people to AuthKit, handle the callback, exchange the code for a user and a session. One endpoint on your side, and the flows behind it are ours to keep current.
Appearance
Customize to fit your needs
Set up the authentication strategies that your app supports, then fine tune the hosted UI to match your app's branding, colours, messaging, and domain.
- Light and dark themes, with the border radius that matches the rest of your product
- Your logo and logo icon, page background, button background and button text colours
- Copy you can rewrite, so the sign-in screen speaks in your product's voice
- Host on your own custom domain (CNAME) — no vendor URL in front of your users
- Changes apply immediately across every organisation, or per organisation when you need it
Headless
Use our hosted UI, or bring your own
Use AuthKit for a polished, customised, hosted UI, or bring your own frontend and connect straight to the User Management APIs. The same flows, the same sessions, either way.
- Go headless without giving up the flows: MFA, SSO handoff and magic links all remain API-driven
- Integrate once and every method your app supports is configurable from the dashboard
- Sessions, refresh and sign-out behave the same whichever surface the user came through
- Move between hosted and headless later without re-modelling your users
Every way your users sign in
One box, every authentication type.
The flows nobody wants to own — and the edge cases nobody remembers until support finds them — handled behind a single integration point.
Authentication APIs you actually want to use
Sign a user in with the code AuthKit hands back.
Redirect out, handle the callback, exchange the code. What you get is a user object and a session — not a protocol to implement.
1import type { NextRequest } from 'next/server';2import Paycux from '@paycux/node';34const paycux = new Paycux('sk_example_123456');5const clientId = 'client_123456789';67// Sign in a user with a valid auth code returned from AuthKit8export const handleAuthentication = async (req: NextRequest) => {9 // The authorization code returned by AuthKit10 const code = req.nextUrl.searchParams.get('code')!;1112 const { user } = await paycux.userManagement.authenticateWithCode({13 code,14 clientId,15 });1617 return user;18};
Transparent pricing
Priced by monthly active user
AuthKit is part of User Management — the hosted UI, the branding controls and the custom domain are not an upgrade tier. You are billed for the people who actually signed in.
Questions
Frequently asked
Can I use AuthKit without giving up my own frontend?
Yes. Go headless and integrate your UI directly with the User Management APIs. You keep the screens; the flows, sessions and edge cases stay ours.
Will my users see a Paycux URL?
Only if you want them to. AuthKit can be hosted on your own domain via CNAME, with your logo, colours and copy, so the sign-in page reads as part of your product.
What happens when my first enterprise customer wants SSO?
Nothing changes in your app. Their work email routes to their identity provider, they configure the connection themselves through Admin Portal, and your login box stays the same shape.
How do I keep users in my own database?
Use the Events API. Every create, update and delete arrives as an event you can apply to your user table, so your database stays the source of truth for your product data.
Can different customers have different rules?
Yes. Authentication policies are set per organisation — allowed domains, permitted strategies, and whether a second factor is required.
Keep exploring
The rest of the platform
Ship the login box today.
Set up your strategies, match your brand, and hand your users a sign-in experience you did not have to build or maintain.