Integrating Role-Based Access Control
How Integrating Role-Based Access Control works in Paycux, what it is for, and the smallest setup that gets it running.
Configure roles and permissions
Roles are defined once per project and assigned per organization membership, so the same person can be an admin in one organization and a viewer in another.
Check permissions on the server, in the request path, using the permission slug rather than the role name. Role names change; slugs are stable.
Integrating with AuthKit
Integrating with AuthKit is handled by Integrating Role-Based Access Control rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Assigning roles
Assign the users and groups who should have access. Anyone outside the assignment is rejected at the provider, before the request reaches Paycux.
Group names sync as-is. If you use groups to drive roles in your application, map them once in the dashboard under Authorization rather than branching on group names in code.
Single vs. multiple roles
Single vs. multiple roles applies specifically to Integrating Role-Based Access Control. It behaves the same in both environments, and the values it depends on are visible in the dashboard for the environment you have selected.
If the behaviour you see does not match this description, check which environment your API key belongs to before anything else — a staging key against production data is the most common cause.
Groups and group role assignments
Groups and group role assignments applies specifically to Integrating Role-Based Access Control. It behaves the same in both environments, and the values it depends on are visible in the dashboard for the environment you have selected.
If the behaviour you see does not match this description, check which environment your API key belongs to before anything else — a staging key against production data is the most common cause.
Using roles and permissions in your app
Using roles and permissions in your app controls what the credential is allowed to do. Grant the narrowest set that lets the integration work, and widen it deliberately.
Scopes are evaluated at the API boundary, so an over-broad token is a real risk even if your own code never uses the extra capability.
Integrating with Directory Sync
Directory Sync keeps your user list in step with the customer's directory. Paycux receives create, update and delete operations and normalizes them into a single shape regardless of the source system.
Deletes arrive as deactivations. Treat a deactivated user as a user who can no longer sign in, and decide separately whether to delete their data.
Integrating with Single Sign-On (SSO)
Integrating with Single Sign-On (SSO) is handled by Integrating Role-Based Access Control rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.