Skip to main content
POST
Exchange a Locus OAuth token for a scoped CLI credential

Authorizations

Authorization
string
header
required

Primary authentication for the hosted MCP resource. Public clients use Authorization Code with PKCE S256. mcp:read covers discovery and resource reads; billed tools/call additionally requires mcp:execute; offline_access requests a rotating refresh token.

Body

application/json
registrationToken
string
required

Canonical base64url encoding of 24 bytes generated by a cryptographically secure random-number generator.

Pattern: ^[A-Za-z0-9_-]{32}$
tools
object

Optional endpoint allowlist. Omit it to leave the credential unrestricted within the workspace's enabled endpoints.

hostname
string

Optional machine name shown in the dashboard. Control characters are removed.

Required string length: 1 - 64

Response

Existing credential renewed (same token) or rotated in place (new token); rotated tells which

success
any
required
created
boolean
required

True when this bootstrap created the installation's credential (HTTP 201).

rotated
boolean
required

True when a new registration token replaced the existing credential's secret in place (HTTP 200).

account
object
required

The Locus user behind the Okibi identity link. Locus provisions an account for an Okibi-verified email that has none; that account keeps a managed password until the person sets one through the emailed link or the dashboard's first screen.

connection
object
required
storage
object
required