Migrate from the standalone SSO API

Introduction

Migrate from the standalone SSO API is part of the Paycux platform. This page explains what it does, when to reach for it, and the smallest working setup you can ship.

Everything below applies to both environments. Build and test in staging, then promote the same configuration to production without changing your code — only the API key and client ID differ.

The new User resource

A user record holds the identity Paycux resolved for the person: email, name, verification state, and the identities they have linked. It is the object your application should key on.

Users are unique by email within a project. When the same person arrives through a second provider, Paycux links the identity to the existing user rather than creating a duplicate.

Switch to AuthKit API calls

Switch to AuthKit API calls is handled by Migrate from the standalone SSO API rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Switch SSO initiation call

Switch SSO initiation call is handled by Migrate from the standalone SSO API rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Switch API in Application Callback

Switch API in Application Callback is handled by Migrate from the standalone SSO API rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Handling new authentication flows

Every API request is authenticated with a bearer token in the Authorization header. Keys are scoped to a single environment and are shown once at creation — store them in a secret manager, not in source control.

1curl -X GET 'https://api.paycux.com/v1/organizations' \
2  -H 'Authorization: Bearer $PAYCUX_API_KEY'

AuthKit

AuthKit is handled by Migrate from the standalone SSO API rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.

Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.

Directory Sync

Directory Sync keeps your user list in step with the customer's directory. Paycux receives create, update and delete operations and normalizes them into a single shape regardless of the source system.

Deletes arrive as deactivations. Treat a deactivated user as a user who can no longer sign in, and decide separately whether to delete their data.