> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. # Begin or complete verified agent-owned signup > A first request creates only a 15-minute pending row and returns an AgentID authorization URL. After AgentID PKCE verification, replaying the same name and registrationToken creates or recovers one zero-balance personal account and returns its scoped connection credential. The verified provider/subject pair is the durable one-account boundary. No free or bonus credits are issued. ## OpenAPI ````yaml /api-reference/openapi.json post /credits/agent/register openapi: 3.1.0 info: title: Locus Pro API description: >- Production is live at https://api.paywithlocus.com/api. Stage remains available for evaluation and integration testing at https://api.stage.paywithlocus.com/api; credentials, balances, and tenant data are isolated by environment. Embedded prepaid credits over the Locus pay-per-use catalog. Money and top-up amounts use exact decimal strings (up to 6dp). Every burn requires an Idempotency-Key header. Management routes accept a tenant secret key or authorized dashboard session as shown per operation. Widget routes accept an end-user JWT alone; when a publishable key is present it must belong to the JWT's tenant. MCP uses OAuth 2.1 Authorization Code with PKCE by default and also accepts the explicitly documented tenant secret key, end-user JWT, or scoped agent connection compatibility credentials. Burns accept the execution credentials shown per operation. Publishable keys never authorize management or burns by themselves. version: 0.6.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: >- Available when enabled for the workspace. Enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: Travel routing description: >- Available when enabled for the workspace. Multi-provider flight search, no-dispatch planning, and feedback - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Available when enabled for the workspace. Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Capability routing description: Outcome-level web search and research across eligible catalog providers paths: /credits/agent/register: post: tags: - Agent-native onboarding summary: Begin or complete verified agent-owned signup description: >- A first request creates only a 15-minute pending row and returns an AgentID authorization URL. After AgentID PKCE verification, replaying the same name and registrationToken creates or recovers one zero-balance personal account and returns its scoped connection credential. The verified provider/subject pair is the durable one-account boundary. No free or bonus credits are issued. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AgentNativeRegistrationRequest' responses: '200': description: Existing verified account replayed, renewed, or recovered content: application/json: schema: $ref: '#/components/schemas/AgentOwnedAccountEnvelope' '201': description: Verified agent-owned account created at a zero balance content: application/json: schema: $ref: '#/components/schemas/AgentOwnedAccountEnvelope' '202': description: >- Only a short-lived pending signup exists; AgentID verification is required content: application/json: schema: $ref: '#/components/schemas/AgentSignupPendingEnvelope' '409': description: The token is bound to different account details '429': description: Registration rate limit exceeded security: [] components: schemas: AgentNativeRegistrationRequest: type: object additionalProperties: false required: - name - registrationToken properties: name: type: string minLength: 1 maxLength: 100 description: Control and bidirectional-formatting characters are rejected. registrationToken: $ref: '#/components/schemas/AgentRegistrationToken' agentEmail: type: string format: email maxLength: 320 description: >- Optional AgentID inbox sent as login_hint. The verified token claim is authoritative. AgentOwnedAccountEnvelope: type: object additionalProperties: false required: - success - account properties: success: const: true account: $ref: '#/components/schemas/AgentOwnedAccount' AgentSignupPendingEnvelope: type: object additionalProperties: false required: - success - account properties: success: const: true account: $ref: '#/components/schemas/AgentSignupPending' AgentRegistrationToken: type: string pattern: ^[A-Za-z0-9_-]{32}$ description: >- Canonical base64url encoding of 24 bytes generated by a cryptographically secure random-number generator. AgentOwnedAccount: type: object required: - id - name - status - onboardingState - balance - connection - identity - mcp - links - nextAction - activated properties: id: type: string format: uuid name: type: string status: type: string onboardingState: type: string enum: - funding_required - ready balance: $ref: '#/components/schemas/AgentOwnedBalance' connection: type: object additionalProperties: false required: - id - keyPrefix - expiresAt properties: id: type: string format: uuid keyPrefix: type: string pattern: ^lcac_ expiresAt: type: string format: date-time credential: type: string pattern: ^lcac_ description: Returned on registration replay and rotation. Store immediately. identity: type: object additionalProperties: false required: - provider - email properties: provider: const: agentid email: type: string format: email mcp: type: object additionalProperties: true links: type: object additionalProperties: type: string format: uri nextAction: type: object additionalProperties: true created: type: boolean credentialRenewed: type: boolean credentialRecovered: type: boolean activated: const: true AgentSignupPending: type: object additionalProperties: false required: - onboardingState - registration - nextAction - activated properties: onboardingState: const: identity_required registration: type: object additionalProperties: false required: - id - provider - status - authorizationUrl - expiresAt - pollAfterMs properties: id: type: string format: uuid provider: const: agentid status: type: string enum: - pending - verified authorizationUrl: type: string format: uri expiresAt: type: string format: date-time pollAfterMs: type: integer minimum: 1000 nextAction: type: object additionalProperties: true activated: const: false AgentOwnedBalance: type: object additionalProperties: false required: - usd - credits - creditsPerDollar properties: usd: $ref: '#/components/schemas/DecimalString' credits: $ref: '#/components/schemas/DecimalString' creditsPerDollar: type: string pattern: ^\d+$ DecimalString: type: string pattern: ^\d+(?:\.\d{1,6})?$ description: >- Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply. securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. ````