Skip to content

Enterprise Single Sign-On

One integration, dozens of identity providers

Save months of development time integrating and debugging SAML and OpenID Connect protocols.

Add SSO to your appRead the docs
Enterprise Single Sign-On
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Single Sign-On

Support your first enterprise customer in days

1

Create a connection

Add the customer as an organization in the Paycux dashboard and open an SSO connection for it. No metadata files traded over email.

2

Let their IT team configure it

Send one Portal Link. The admin picks their identity provider and follows setup docs written for that exact provider, at their own pace.

3

Redirect and read the profile

Point your sign-in button at the Paycux authorization URL. You get back one normalized profile object, whichever provider issued it.

Your app's first step toward enterprise adoption

B.Y.O. database, UX, and UI. We'll provide the auth.

Paycux was designed to seamlessly fit into your existing application. With a few lines of code, you can offer the most popular enterprise sign-in options and support your biggest customers as quickly as possible.

  • SAML and OpenID Connect behind a single API
  • Integrate into your existing login UI and authentication flows
  • Bring your own database and manage your own user records
  • Encode navigation state so redirects land where the user left off
Your app's first step toward enterprise adoption
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

OAuth providers

Integrate popular OAuth providers like Google and Microsoft

Leverage the same Single Sign-On API interface to connect with other OAuth services. Add high-conversion authentication options without having to build and manage them yourself.

  • Google OAuth with the same profile shape as SAML
  • Microsoft OAuth without a second integration
  • One callback route handles every connection type
  • Move a customer from OAuth to SAML without touching your code
OAuth providers
Available on every plan
Enabled for your workspace
Configured by your customer
3Streaming to your systems

Developer-first design

Clean, consistent, and modern API design

Offer SSO for any identity provider that speaks SAML or OpenID Connect, all in a standard OAuth 2.0 connection wrapper.

Developer-first designAPIs with RESTful endpoints, JSON responses, and normalized objects.
Fits your existing UX / UIIntegrate into existing login UI, authentication flows, and user communication methods.
Your data stays with youBring your own database and manage your own user records. We'll provide the auth.
Persistable navigation stateEncode useful information to help restore application state between redirects.
Every provider, one interfaceOkta, Entra ID, Google Workspace, OneLogin, Ping Identity, ADFS and any other SAML or OIDC provider.
Connection health you can seeWatch a connection move from draft to live, and hear about an expiring certificate before sign-in breaks.

SDKs

Generate an authorization URL in a few lines

Modern SDKs for the languages you already ship in, plus a plain HTTP API for when you would rather not add a dependency.

1// Generate an authorization URL that automatically
2// directs a user to their Identity Provider
3import Paycux from '@paycux/node';
4 
5const paycux = new Paycux('sk_example_123456');
6 
7paycux.sso.getAuthorizationURL({
8  organization: 'org_01EHZNVPK3SFK441A1RGBFSHRT',
9  clientID: 'client_123456789',
10  redirectURI: 'https://example.com/callback',
11  state: 'dj1kUXc0dzlXZ1hjUQ==',
12});

Transparent pricing

Priced by connection

Enable your app to accept single sign-on from dozens of identity providers with a single integration. You pay for live connections, and the rate per connection drops as their number grows.

See full pricingTalk to an expert
First 15 connectionsContact us
16-30 connectionsVolume pricing
31-100 connectionsVolume pricing
Beyond 100 connectionsTalk to us
Custom enterprise planContract-based

Questions

Frequently asked

Which identity providers are supported?

Any provider that speaks SAML 2.0 or OpenID Connect, which covers Okta, Microsoft Entra ID, Google Workspace, OneLogin, Ping Identity, JumpCloud, ADFS, Auth0, Keycloak and the rest. You integrate once; adding a provider is a dashboard change, not a release.

Do I have to move my user records into Paycux?

No. Bring your own database. Paycux returns a normalized profile after authentication and you decide what to store, so your user table stays yours.

Who configures the connection, us or the customer?

Either. Your team can set a connection up from the dashboard, or you can send the customer an Admin Portal link so their IT admin completes it themselves with provider-specific instructions.

How is this different from adding SAML myself?

The protocol is the easy part. What takes months is the long tail of provider quirks, certificate rotation, attribute mapping and debugging someone else's identity provider. That work is what Paycux absorbs.

What happens when a signing certificate expires?

Paycux tracks certificate validity per connection and surfaces the expiry ahead of time, so the customer's admin can rotate it before anyone is locked out.

Keep exploring

The rest of the platform

User ManagementComplete auth and user management platform
RadarRealtime protection against bots, fraud and abuse
AuthKitCustomisable UI for every authentication type
Directory SyncUser lifecycle from corporate directories
Role-Based Access ControlPowerful and flexible permissions for your users
MCP AuthSecure auth for MCP servers

The quickest way to up-market

Adding SSO is the quickest way to get a head start on enterprise adoption. Integrate SSO in a few days, free up your roadmap, and get back to building your app.

Get startedTalk to an expert