Notes from the people building it

Add sign-in to an Android app with the Paycux Android SDK

The best signal that a feature is right is not that people ask for it.

24 August 2026

Why regex isn't email validation

The engineering questions that matter are rarely about which tool.

24 August 2026

Auth0 Enterprise Connect in beta vs. Paycux for enterprise SSO and SCIM

The best signal that a feature is right is not that people ask for it.

21 August 2026

Enterprise3 min read

How to add enterprise SSO to an Express.js API

Moving upmarket is usually described as a go-to-market decision.

21 August 2026

Enterprise7 min read

Enterprise readiness is a distribution problem

The features an enterprise buyer asks for are rarely interesting to build. That is exactly why they decide who gets to sell.

19 August 2026

Enterprise8 min read

The security review is four reviews in one document

One spreadsheet arrives and four different people are behind it. Answering it well starts with working out which question belongs to whom.

How to store and refresh session tokens correctly with the Paycux iOS SDK

The best signal that a feature is right is not that people ask for it.

Protocols4 min read

RFC 9470 explained: The OAuth step-up authentication challenge protocol

The value of a standard is that two parties who have never spoken can interoperate.

Security3 min read

Session lifetime is a security control, not a UX setting

The useful frame is not "is this secure" but "what does an attacker get if this one thing goes wrong, and how quickly would we know".

Protocols9 min read

The SAML signature checks that get skipped

Every library will tell you the signature verified. That sentence has at least four meanings, and only one of them is safe.

Agent Night demo recap: Brian Douglas's self-healing Pokémon agent

Most of the difficulty with agents is not the model.

Agent Night demo recap: Evil Martians on making your docs discoverable to agents

Most of the difficulty with agents is not the model.

Agent Night demo recap: exe.dev — your agent can rewrite the software you use

Most of the difficulty with agents is not the model.

Agent Night demo recap: How Mastra turned its issue backlog into a software factory

Most of the difficulty with agents is not the model.

Agent Night panel recap: AGI arrived, or it's a skill issue

Agents changed the shape of the problem.

Agent Night recap: Airlock and intent-based access control

Most of the difficulty with agents is not the model.

What it's like to join Paycux as a product designer

Shipping is the easy half.

Running the Paycux API locally

Every feature carries a maintenance bill that comes due long after the launch post.

Step-up authentication for AI agents

Most of the difficulty with agents is not the model.

Paycux Applied AI Showcase July 28 2026 - Moving to an AI-native Organization

The uncomfortable part of building for agents is that the old assumptions quietly stop holding.

How to switch models in Claude Code with one command

Most of the difficulty with agents is not the model.

Stop giving your coding agent a million-token context window

The uncomfortable part of building for agents is that the old assumptions quietly stop holding.

Protocols3 min read

Retiring home-grown SCIM without anyone noticing

The value of a standard is that two parties who have never spoken can interoperate.

Product7 min read

Putting SSO behind a plan without locking anyone out

Enterprise sign-on ends up on the top tier in almost every product. The design question is not whether to gate it, but what the gate does on the day a plan lapses.

13 August 2026