Loading page
Agent Access
From the October 2026 release an owner, admin or developer can mint an agent connection through the API: a token that expires minutes after it is minted, is bound to one project's development environment and lets the agent read the project's public integration contract. There is no console page and no distributed client yet, and verification runs are planned.
Available in part — Agent Access: Agent connections and the project contract are available through the HTTP API from the October 2026 release; there is no console page and no distributed client yet. Items listed as planned below cannot be enabled yet. What Paycux provides today.
Status
How it works
An owner, admin or developer posts the project id. The API finds the project's development environment, records the request in the audit ledger and returns the token once, with its expiry and capabilities. Preview and production are refused.
The agent presents the token with the project id and the environment name. Activation is a one-time state change: a second attempt answers 409 AGENT_ALREADY_ACTIVATED, an expired token 401 AGENT_TOKEN_EXPIRED.
GET /v1/agent/contract answers with the public contract for the linked environment. Revoking the connection by id from the console session makes the next call answer 401 AGENT_TOKEN_REVOKED.
Scope
The blast radius of a leaked agent token is kept small enough to be boring. A token cannot be minted for preview or production, cannot outlive its expiry and cannot be activated for a different project than the one it was minted for.
Secrets
The contract an agent reads is validated against a schema that rejects anything shaped like an API key, a webhook secret or an agent token. Provider credentials stay in OpenBao and are leased by the API only for the request that needs them.
Available through the API
The connection and contract routes are part of the deployed API from this release. Verification runs, a console page and distributed clients are planned.
On the wire
Mint with your session cookie, activate and read with the agent token, revoke with the session cookie again.
1# Console session: owner, admin or developer2curl -X POST https://api.paycux.com/v1/agent/connections \3 --cookie "__Host-paycux_session=<session cookie>" \4 -H "Content-Type: application/json" \5 -d '{ "projectId": "<project id>" }'67# 201 Created8{9 "token": "pcx_<connection id>.<secret>",10 "projectId": "<project id>",11 "environmentId": "<development environment id>",12 "expiresAt": "2026-10-13T09:05:00.000Z",13 "capabilities": ["contract:read", "verification:start", "verification:read"]14}
Transparent pricing
In part No separate price for what works today.Workspace plans
Included in every workspace plan. Limits (projects, provider connections, members, usage events) are listed on the pricing page.
Questions
Through the API, from this release: mint, activate, revoke and read the contract. There is no console page yet, the CLI and the MCP server are not distributed, and verification runs answer 503 VERIFICATION_NOT_CONFIGURED until the hosted runner ships.
Paycux keeps development, preview and production data and secrets strictly apart, and an agent connection is meant to be short-lived and scoped to one project and one environment. Tokens for preview and production are planned as audience-bound tool tokens with their own permissions, not as an extension of the development token.
No. Provider credentials are stored in OpenBao and leased only by API routes that need them. The contract an agent reads is validated against a schema that refuses secret-like strings, and no agent route returns a credential.
Not yet. Both exist in the codebase as private workspace packages named paycux and paycux-mcp, with tests, and both read the token from a protected pipe. They are not published, so there is nothing to install today; use the HTTP routes directly until they ship.
Post to the revoke route with the connection id from the console session. The token answers 401 AGENT_TOKEN_REVOKED from the next call. A token that is never revoked still expires minutes after it was minted.
Keep exploring
Create a workspace, register a project and mint a development-only connection with your session. The contract your agent reads carries no secrets.