Skip to content

Pipes

Integrations for your apps and agents.

Connect to any service in minutes, with pre-built OAuth flows, UI widgets, and more.

Get startedRead the docs
Pipes
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

One API to rule them all.

Your users connect their tools. Your app gets the access token.

1

User connects via the Widget

Drop in the Widget. Users authorise via OAuth and the refresh token stays in Pipes — it never lands in your database and never appears in your logs.

2

You call getAccessToken()

One call returns a valid token, always. Pipes handles expiry, refresh, and concurrency, so two workers asking at the same moment do not race each other into a revoked grant.

3

Credentials stored in Vault

Scoped to the user, stored in Vault, ready to use. Every token is encrypted at rest, and revoking access is a single call rather than a migration.

Agents

Supercharge your agents with integrations.

More context makes for smarter products. And smarter products win — as long as the credentials behind that context can survive an overnight run.

  • Agents need context. Give it to them: let agents work with data from your users' other apps.
  • Agents take actions. Keep them safe: scoped consent means your agent can only access what was granted.
  • Credentials are a liability. Move them off your stack: tokens are stored encrypted and revoked with a single call.
  • Your agent runs for hours. Most integrations assume a human is driving; an agent running overnight needs credentials that refresh automatically.
Agents
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Trust

Keep the trust. Move the risk.

When your app stores a customer's refresh token, you're holding a key to their data. Pipes takes that liability off your stack.

  • Session-scoped credentials — tied to a single session, with access expiring automatically when it ends
  • GDPR — data handling and residency options designed around the obligations your customers audit you against
  • SOC 2 (planned) — the compliance posture Pipes inherits from the Paycux platform as it is certified
  • PKCE by default — Pipes always picks the strongest available auth flow
  • Vault-backed storage — every token encrypted at rest via AES-256
Trust
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

A unified platform for every integration

Say goodbye to fragmented integrations.

With Pipes, a single crisp API gets your app — or your agent — a token. One connection model, whoever is driving.

MCP-native interfaceConnect your agents to Pipes over MCP. One server, every tool your user authorised, with the grants they actually approved.
Survives refreshSay goodbye to failures from expired credentials. Tokens from Pipes are automatically refreshed before the call that needed them.
Human or agent: same primitiveUse the same connection for user or agent integration. One authorisation, two actors, no second code path to maintain.
Revocation in one callWhen a user disconnects, access stops instantly. No token still sitting somewhere in a queue, a cache, or a backup.
Connect your app to the worldPopular SaaS apps are supported out of the box across software development, comms, storage, commerce, CRM and marketing. Connect a custom app and Pipes handles it the same way via OAuth or API key.
Start with integrations. Scale with Paycux.Pipes sits alongside SSO, Directory Sync, Audit Logs and AuthKit. Same API key, same dashboard, same managed platform.

A single crisp API

One call gets your app — or your agent — a valid token.

Read the docs, get your API key, and stop writing the same refresh loop for the fifth provider this quarter.

1// Always returns a valid token: expiry and refresh handled for you
2import Paycux from '@paycux/node';
3 
4const paycux = new Paycux('sk_example_123456789');
5 
6const token = await paycux.pipes.getAccessToken({
7  userId: 'user_01EHZNVPK3SFK441A1RGBFSHRT',
8  organizationId: 'org_01EHZNVPK3SFK441A1RGBFSHRT',
9  provider: 'github',
10});

Transparent pricing

Priced by connected account

A connected account is one user authorising one provider. Refreshes, retries and revocations are part of the connection rather than a metered extra.

See full pricingTalk to an expert
Pre-built OAuth providersIncluded
Custom apps (OAuth or API key)Included
Widget and MCP interfaceIncluded
Vault-backed token storageIncluded
Custom enterprise plansContact sales

Questions

Frequently asked

Where does the refresh token actually live?

In Vault, encrypted at rest, scoped to the user who granted it. Your app only ever sees a short-lived access token, which is what makes a leak in your logs survivable.

What happens when two workers ask for a token at once?

Pipes serialises the refresh. Both callers get a valid token and the provider sees one refresh, so you do not lose a grant to a concurrency race at three in the morning.

Can I connect a service that is not on the list?

Yes. Connect a custom app and Pipes handles it the same way, via OAuth or an API key, with the same widget, the same storage and the same revocation call.

How do agents use Pipes differently from users?

They do not. The connection is the same primitive — one authorisation, two actors. Over MCP, an agent gets exactly the tools its user authorised, and nothing else.

What does a user disconnecting actually do?

Revocation is immediate and single-call: the stored credential is destroyed and every subsequent token request for that connection fails. There is no cached copy to chase.

Keep exploring

The rest of the platform

User ManagementComplete auth and user management platform
Enterprise SSOUnified SSO for any identity provider
RadarRealtime protection against bots, fraud and abuse
AuthKitCustomisable UI for every authentication type
Directory SyncUser lifecycle from corporate directories
Role-Based Access ControlPowerful and flexible permissions for your users

Ship integrations faster with Pipes.

One connection model for every service your product and your agents have to reach — with the credential risk off your stack.

Get startedTalk to an expert