SAML Security Considerations
How SAML Security Considerations works in Paycux, what it is for, and the smallest setup that gets it running.
SAML Binding Methods
SAML Binding Methods is handled by SAML Security Considerations rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
SP to IdP security features
SP to IdP security features is handled by SAML Security Considerations rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
SAML request signing
Paste the provider's metadata URL into the connection. Paycux reads the signing certificate and endpoints from it and re-reads them on a schedule, so a certificate rotation does not break the connection.
Static metadata
If the provider only offers a metadata file rather than a URL, upload the XML instead. Static metadata does not auto-refresh — set a calendar reminder for the certificate expiry date.
IdP to SP security features
IdP to SP security features is handled by SAML Security Considerations rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Signed response assertions
Signed response assertions is handled by SAML Security Considerations rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Signed response message envelope
Signed response message envelope is handled by SAML Security Considerations rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Encrypted response assertion
Vault stores secrets encrypted with a key that never leaves the key manager. Your application sends plaintext and receives a ciphertext handle; the plaintext is never written to disk.
Keys can be Paycux-managed or supplied by the customer. Customer-managed keys let a customer revoke access to their own data without involving you.
Encrypted response attributes
Paycux normalizes incoming attributes into a fixed profile shape, so your application reads the same fields no matter which provider the user came from.
| Paycux field | Typical source |
|---|---|
| NameID, email, or mail | |
| first_name | givenName or first_name |
| last_name | surname, sn, or last_name |
| idp_id | The provider's stable user identifier |
Anything the provider sends beyond these fields is kept verbatim under raw_attributes, so you can map custom claims without waiting on us.