Reauthentication
How Reauthentication works in Paycux, what it is for, and the smallest setup that gets it running.
Introduction
Reauthentication is part of the Paycux platform. This page explains what it does, when to reach for it, and the smallest working setup you can ship.
Everything below applies to both environments. Build and test in staging, then promote the same configuration to production without changing your code — only the API key and client ID differ.
Read the auth_time claim
Paycux normalizes incoming attributes into a fixed profile shape, so your application reads the same fields no matter which provider the user came from.
| Paycux field | Typical source |
|---|---|
| NameID, email, or mail | |
| first_name | givenName or first_name |
| last_name | surname, sn, or last_name |
| idp_id | The provider's stable user identifier |
Anything the provider sends beyond these fields is kept verbatim under raw_attributes, so you can map custom claims without waiting on us.
Prompt the user to re-authenticate
A user record holds the identity Paycux resolved for the person: email, name, verification state, and the identities they have linked. It is the object your application should key on.
Users are unique by email within a project. When the same person arrives through a second provider, Paycux links the identity to the existing user rather than creating a duplicate.
Redirect to AuthKit with max_age
Redirect to AuthKit with max_age is handled by Reauthentication rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Best practices
Best practices is handled by Reauthentication rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.