Session resilience

Introduction

Session resilience is part of the Paycux platform. This page explains what it does, when to reach for it, and the smallest working setup you can ship.

Everything below applies to both environments. Build and test in staging, then promote the same configuration to production without changing your code — only the API key and client ID differ.

Refresh token rotation

Access tokens are JWTs signed with a rotating key. Verify them against the JWKS endpoint for your client rather than a pinned public key, so rotation never causes an outage.

1https://api.paycux.com/sso/jwks/client_01M4KXD1PZXFWGWE9ZKPCQRAQ

Cache the key set and re-fetch on an unknown key ID. Reject any token whose issuer, audience or expiry does not match what you expect.

The replay grace period

The replay grace period is handled by Session resilience rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Terminal vs. transient failures

The Paycux CLI wraps the same API the SDKs use. Authenticate once, then run commands against whichever environment you select.

1paycux login
2paycux env use staging
3paycux organizations list

Handling a failed refresh

Handling a failed refresh is handled by Session resilience rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Examples

Examples is handled by Session resilience rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Without an SDK

Official SDKs are published for Node.js, Python, Ruby, Go, PHP, Java and .NET. They share the same method names, so a snippet translates between languages with little more than syntax changes.

Each SDK reads PAYCUX_API_KEY from the environment by default and retries idempotent requests on transport errors.

Staying available during a service disruption

Staying available during a service disruption is handled by Session resilience rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.