Enterprise Single Sign-On

Per-organisation SAML and OIDC connections, planned

Paycux does not offer enterprise single sign-on today. Each environment has one isolated identity realm with exact redirect URL registration, and organisations invite members by verified e-mail. Per-organisation identity provider connections, domain routing and connection tooling are planned.

What exists today Planned integration

Enterprise Single Sign-OnPlanned

Roadmap preview

1Not available yet

2Planned

3Planned

Not available yet — Enterprise SSO is a planned capability. It is not part of Paycux today and cannot be enabled from the console. What Paycux provides today.

This preview is not a currently available API contract.

Status

What exists today, and what is planned

Works today

PlannedPlanned

PlannedPer-organisation SAML and OIDC connections
PlannedIdentity provider metadata import and certificate rotation
PlannedDomain-based routing to the right connection
PlannedProtections for IdP-initiated flows
PlannedTest connection tooling

Planned

How the planned flow would work

Connect

An organisation would register its identity provider from metadata, and Paycux would hold the signing certificate and rotate it when the provider does.

Route

A verified e-mail domain would route sign-in to that organisation's connection; other users would keep the realm's own screens.

Verify

Test connection tooling would confirm the assertion before the connection is activated, and IdP-initiated flows would be refused or bound to a known request.

Foundation

What exists underneath today

None of this is single sign-on. It is the identity and organisation groundwork a connection would build on.

One identity realm per environment with its own issuer
Exact redirect and logout URL registration from the console
Organisations created by end users, with owner, admin and member roles
Invites accepted only with the same verified e-mail; tokens stored hashed and expiring after seven days

FoundationPlanned

Roadmap preview

1Not available yet

2Planned

3Planned

Planned

What the product would add

Listed so you can judge fit. None of it can be enabled, and no contract for it exists.

SAML and OIDC connections per organisation
Metadata import, certificate rotation and expiry visibility
Domain-based routing and IdP-initiated flow protections
Test connection tooling before activation

PlannedPlanned

Roadmap preview

1Not available yet

2Planned

3Planned

Planned scope

Nothing here can be turned on today

Each item is planned unless it says otherwise. The foundation items at the top of the page are the only parts that exist.

Per-organisation connectionsPlanned: a SAML or OIDC connection owned by one organisation.

Metadata and certificatesPlanned: import identity provider metadata and rotate signing certificates.

Domain-based routingPlanned: send a verified e-mail domain to its organisation's connection.

IdP-initiated protectionsPlanned: unsolicited assertions refused or bound to a known request.

Test connection toolingPlanned: run a connection end to end before activating it.

Organisation invites (exists today)End users invite members by e-mail and accept with a verified address. This is the membership model a connection would map onto.

Foundation today

The realm and organisations a connection would attach to

These reads exist today. No connection object, metadata route or domain routing exists.

1curl "https://api.paycux.com/v1/environments/<environment id>/auth?projectId=<project id>" \
2  --cookie "__Host-paycux_session=<session cookie>"
3 
4HTTP 200
5{
6  "setup": {
7    "realmId": "<realm id>",
8    "displayName": "Example App",
9    "redirectUris": ["https://app.example.com/auth/callback"],
10    "logoutRedirectUris": ["https://app.example.com/"],
11    "status": "ready",
12    "issuer": "https://<identity host>/realms/pcx-<uuid>",
13    "clientId": "<client id>",
14    "discoveryUrl": "https://<identity host>/realms/pcx-<uuid>/.well-known/openid-configuration",
15    "lastErrorCode": null
16  }
17}
18# The full object also carries workspaceId, projectId, environmentId,
19# providerRealmName, checkoutReturnUrls, revision and appliedRevision.
20# There is no connection or identity provider field.

Questions

Frequently asked

Can I turn this on today?

No. There is no connection object, no SAML or OIDC route for customer identity providers and no console screen for it.

Can my customer sign in with their own identity provider in the meantime?

No. Every user of an environment signs in on the realm's own screens with e-mail and password.

What exists for organisations today?

End users create organisations through the API, invite members as member or admin, and accept with a matching verified e-mail. Workspace operators can view organisations and revoke invites from the console.

Which protocols are planned?

SAML and OIDC connections per organisation, with metadata import, certificate rotation, domain-based routing, IdP-initiated flow protections and test tooling. The contract is not committed.

Will I need to change my sign-in integration later?

The planned design keeps the realm as the entry point so an application's authorization code flow would stay the same. That is a design intent, not a commitment.

Keep exploring