Multi-Factor Authentication

A second factor for your users, planned

Paycux does not offer multi-factor authentication today. Identity realms are isolated per environment and brute-force protected, and the identity provider behind them is capable of one-time-code factors, but no MFA policy, enrolment or recovery flow is exposed. This page describes the planned product.

What exists today Planned integration

Multi-Factor AuthenticationPlanned

Roadmap preview

1Not available yet

2Planned

3Planned

Not available yet — Multi-Factor Authentication is a planned capability. It is not part of Paycux today and cannot be enabled from the console. What Paycux provides today.

This preview is not a currently available API contract.

Status

What exists today, and what is planned

Works today

PlannedPlanned

PlannedEnrolment with an authenticator app
PlannedRecovery codes
PlannedPer-organisation MFA requirement
PlannedStep-up verification for sensitive actions
PlannedAdmin reset of a user's factors
PlannedAudit of factor changes

Planned

How the planned flow would work

Enrol

A signed-in user would register an authenticator app on the realm's screens and receive recovery codes once.

Require

An organisation could require a second factor for its members, and a policy could demand a fresh challenge before sensitive actions.

Recover

A user who loses the device would use a recovery code, or an admin would reset the factor, with every change audited.

Foundation

What exists underneath today

None of this is a multi-factor product. It is the identity groundwork the planned feature would build on.

One identity realm per environment, provisioned from the console
Brute-force protection on every realm
Mandatory e-mail verification before a token is accepted
Exact redirect URLs and PKCE on a public client

FoundationPlanned

Roadmap preview

1Not available yet

2Planned

3Planned

Planned

What the product would add

The planned scope is listed so you can judge fit. None of it can be enabled, and no contract for it exists.

Authenticator app enrolment and recovery codes
Per-organisation MFA requirement
Step-up verification for sensitive actions
Admin factor reset and an audit trail of factor changes

PlannedPlanned

Roadmap preview

1Not available yet

2Planned

3Planned

Planned scope

Nothing here can be turned on today

Each item is planned. The foundation items at the top of the page are the only parts that exist.

Authenticator app enrolmentPlanned: enrol a time-based one-time-code app on the hosted screens.

Recovery codesPlanned: single-use codes issued at enrolment for a lost device.

Per-organisation requirementPlanned: an organisation can require a second factor for all of its members.

Step-up verificationPlanned: a fresh challenge before a sensitive action, not only at sign-in.

Admin resetPlanned: a workspace admin removes a user's factor so they can enrol again.

Audit of factor changesPlanned: enrolments, resets and failed challenges recorded in the audit ledger.

Foundation today

The realm the planned factors would attach to

These two reads exist today. No MFA endpoint exists, and neither response carries factor fields.

1curl "https://api.paycux.com/v1/environments/<environment id>/auth?projectId=<project id>" \
2  --cookie "__Host-paycux_session=<session cookie>"
3 
4HTTP 200
5{
6  "setup": {
7    "realmId": "<realm id>",
8    "displayName": "Example App",
9    "status": "ready",
10    "issuer": "https://<identity host>/realms/pcx-<uuid>",
11    "clientId": "<client id>",
12    "discoveryUrl": "https://<identity host>/realms/pcx-<uuid>/.well-known/openid-configuration",
13    "lastErrorCode": null
14  }
15}
16# The full object also carries workspaceId, projectId, environmentId,
17# providerRealmName, redirectUris, logoutRedirectUris, checkoutReturnUrls,
18# revision and appliedRevision. There is no MFA field.

Questions

Frequently asked

Can I turn this on today?

No. There is no MFA setting in the console and no MFA route in the API. The identity provider behind the realms is capable of one-time-code factors, but Paycux does not expose that capability.

Which factors are planned?

Authenticator apps with time-based one-time codes, plus recovery codes, are the planned first factors. The final contract is not committed.

What protects accounts in the meantime?

Mandatory e-mail verification, brute-force protection on every realm, exact redirect URLs and PKCE. These are foundation controls, not a second factor.

Will MFA be required per organisation or per user?

The planned scope includes a per-organisation requirement and per-user enrolment. Nothing supports either today.

Will I be able to require a fresh factor before a sensitive action?

Step-up verification is in the planned scope. Nothing supports it today.

Keep exploring