User Management
Sign up, sign in, provision and manage users at scale
A complete solution for authentication, authorization, user management and provisioning, from your first user to your largest enterprise customer.
AuthKit
Add auth to your app in minutes
Pick your strategies
Turn on the authentication strategies your app supports: email and password, social, Magic Auth, multi-factor and enterprise SSO.
Match your branding
Fine tune the hosted AuthKit UI to your app's branding, colours, messaging and domain, or bring your own frontend for complete control.
Keep your database in sync
Subscribe to the Events API and your own user table stays current as people are created, updated, provisioned and removed.
User Management APIs
Customize to fit your needs
User Management APIs unlock custom user flows to fit your app's business logic, and the Events API keeps your database in sync.
- An auth stack that scales with you: Single Sign-On, Directory Sync, Multi-Factor Auth and Paycux organizations in one place
- Enterprise-scale user management with organization-level authentication policies
- Just-In-Time (JIT) and Directory Sync (SCIM) provisioning, per organization
- Secure and flexible RBAC, with roles and permissions carried in the session
Events API
Use the Events API to sync users to your DB
Keep your user data in your user table. When something changes in Paycux, the Events API gives your app realtime updates instead of a nightly reconciliation job.
- Out-of-the-box auth flows, or go headless and drive the APIs yourself
- Integrate once and change strategies from the dashboard, not in a release
- Ordered, replayable events so a missed webhook is not a missed user
- Automatic spam and bot detection, password strength validation and leaked password protection
User Management
From your first user to your largest enterprise customer
One integration point that covers the hobby project on day one and the enterprise procurement review two years later.
Developer-first design
Authentication APIs that you actually want to use
Sign a user in with the code AuthKit hands back, and get a user object you can save straight into your own table.
1import type { NextRequest } from 'next/server';2import Paycux from '@paycux/node';34const paycux = new Paycux('sk_example_123456');5const clientId = 'client_123456789';67// Sign in a user with a valid auth code returned from AuthKit8export const handleAuthentication = async (req: NextRequest) => {9 // The authorization code returned by AuthKit10 const code = req.nextUrl.searchParams.get('code');1112 // Sign in a user with the code13 const { user } = await paycux.userManagement.authenticateWithCode({14 code,15 clientId,16 });1718 return user;19};
Transparent pricing
Priced by monthly active user
Flexible user management, authentication and provisioning that scales with your customer needs. You are billed for the people who actually signed in, not for every row in the table.
Questions
Frequently asked
Do I have to use the hosted UI?
No. AuthKit is there when you want the login box handled for you, but every screen it renders is backed by a public API. Go headless and build your own frontend against the same endpoints whenever you prefer.
Where do my users actually live?
In Paycux, with a copy wherever you want one. The Events API streams creations, updates and deletions in realtime so your own user table can stay authoritative for everything your product cares about.
Can different customers have different sign-in rules?
Yes. Authentication policy is set per organization: allowed domains, which strategies are permitted, and whether multi-factor is required. One customer can be SSO-only while another still uses passwords.
How does provisioning work for enterprise customers?
Two ways, both per organization. Just-In-Time provisioning creates the user on first successful sign-in, and Directory Sync (SCIM) creates, updates and deactivates users as their directory changes.
What about migrating users we already have?
Import them with the API, keeping your existing identifiers, and let people continue signing in with the credentials they already use. Enterprise SSO can be switched on for a customer later without touching those records.
Keep exploring
The rest of the platform
Ship the auth layer this week
Create an account, wire sign-in to Paycux, and spend the rest of the sprint on the part of the product that is actually yours.