Google OIDC

Introduction

This guide connects Google to Paycux over OIDC. Work through it once per organization — each customer gets their own connection, with its own values.

You configure two sides: the application inside the provider, and the connection inside the Paycux dashboard. Neither side is complete on its own, so keep both tabs open.

What Paycux provides

Paycux generates two values for every connection and shows them in the dashboard under the connection's settings. You paste these into the identity provider when you configure the application:

Both values are per connection. Do not reuse them across organizations — each organization gets its own connection and its own pair.

What you'll need

Before you start, make sure you have the following in place:

• A Paycux account with access to the project you are configuring.
• An API key for the environment you are working in. Staging keys start with sk_test_; production keys start with sk_live_.
• Admin access on the system you are connecting, so you can create the application and read its metadata.
• A redirect URI registered in the Paycux dashboard under Developer → Redirects.

Create a Google Cloud project (optional)

In Google OIDC, complete this step before moving on. The values Paycux generated for this connection are on the connection page in the dashboard — copy them from there rather than retyping.

Configure OAuth app

Configure OAuth app is configured per environment in the dashboard, so staging and production can differ while your application code stays identical.

Changes take effect on the next request. There is no deploy step and no cache to clear.

Create OAuth client

The Paycux CLI wraps the same API the SDKs use. Authenticate once, then run commands against whichever environment you select.

1paycux login
2paycux env use staging
3paycux organizations list

Add organization settings

An organization is the tenant boundary in Paycux. Connections, directories, roles and audit log streams all hang off an organization, and a user reaches your application through a membership in one.

Create an organization per customer, not per environment. The same organization exists in staging and production with separate configuration.

Verify the connection

Verify the setup end to end before you hand it to a customer. Run the flow from a private browser window so no existing session masks a broken step.

1. 1Open the connection in the dashboard and confirm its status reads Active.
2. 2Start the flow from your application, not from the provider, so the redirect URI is exercised.
3. 3Sign in as a test user and confirm the profile arrives with an email address.
4. 4Check the connection's event list — a successful sign-in appears within a few seconds.

Troubleshooting

If something does not work, check these first — they cover the large majority of failed setups:

• The values were pasted into the wrong environment. Staging and production hold separate configuration.
• A trailing slash or stray whitespace in the ACS URL or redirect URI. Both are matched exactly.
• The connection is saved but not activated. An inactive connection returns connection_inactive.
• Attribute names differ from what the mapping expects, so the user is created without an email address.

Every failed authentication is recorded with a reason on the connection's page in the dashboard. Start there before reading application logs.