Skip to content
Fine-Grained Authorization

Protecting API Endpoints

How Protecting API Endpoints works in Paycux, what it is for, and the smallest setup that gets it running.

What you’ll build

Before you start, make sure you have the following in place:

  • A Paycux account with access to the project you are configuring.
  • An API key for the environment you are working in. Staging keys start with sk_test_; production keys start with sk_live_.
  • Admin access on the system you are connecting, so you can create the application and read its metadata.
  • A redirect URI registered in the Paycux dashboard under Developer → Redirects.

The check pattern

The check pattern is handled by Protecting API Endpoints rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Read a resource

Read a resource is handled by Protecting API Endpoints rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Create a resource

Create a resource is handled by Protecting API Endpoints rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Update a resource

Update a resource is handled by Protecting API Endpoints rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Delete a resource

Delete a resource is handled by Protecting API Endpoints rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

A reusable check middleware

A reusable check middleware is handled by Protecting API Endpoints rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Return 404 instead of 403

Return 404 instead of 403 is handled by Protecting API Endpoints rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.