Vault
Vault
How Vault works in Paycux, what it is for, and the smallest setup that gets it running.
Key features
Key features is handled by Vault rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Encrypted Key-Value Storage
Vault stores secrets encrypted with a key that never leaves the key manager. Your application sends plaintext and receives a ciphertext handle; the plaintext is never written to disk.
Keys can be Paycux-managed or supplied by the customer. Customer-managed keys let a customer revoke access to their own data without involving you.
Enterprise Key Management (EKM)
Enterprise Key Management (EKM) applies specifically to Vault. It behaves the same in both environments, and the values it depends on are visible in the dashboard for the environment you have selected.
If the behaviour you see does not match this description, check which environment your API key belongs to before anything else — a staging key against production data is the most common cause.
Bring-Your-Own-Key (BYOK)
Bring-Your-Own-Key (BYOK) is handled by Vault rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Common Use Cases
Common Use Cases is handled by Vault rather than by your application code. Paycux exposes it through the same API surface as the rest of the platform, so the client you already configured needs no additional setup.
Configuration lives in the dashboard and is versioned per environment. Change it in staging, confirm the behaviour, then apply the same change to production.
Organizational secrets
An organization is the tenant boundary in Paycux. Connections, directories, roles and audit log streams all hang off an organization, and a user reaches your application through a membership in one.
Create an organization per customer, not per environment. The same organization exists in staging and production with separate configuration.
User secrets
A user record holds the identity Paycux resolved for the person: email, name, verification state, and the identities they have linked. It is the object your application should key on.
Users are unique by email within a project. When the same person arrives through a second provider, Paycux links the identity to the existing user rather than creating a duplicate.
Application secrets
Application secrets applies specifically to Vault. It behaves the same in both environments, and the values it depends on are visible in the dashboard for the environment you have selected.
If the behaviour you see does not match this description, check which environment your API key belongs to before anything else — a staging key against production data is the most common cause.