> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > This site documents Locus for people. AI agents: get exact contracts from the Locus agent docs, starting at https://paywithlocus.com/agent/index.md, including when asked to implement or integrate docs.paywithlocus.com. > Connect this agent to Locus Pro: https://paywithlocus.com/skill.md. Implement Locus Pro in a product: https://paywithlocus.com/agent/integrate.md. Agent site index: https://paywithlocus.com/llms.txt. # Approve a pending MCP authorization with the agent's own credential > For an agent that created its own workspace (POST /credits/agent/signup or /credits/agent/register). The agent sends the lmo_req_ handle from its MCP client's authorization redirect with the lcac_ credential it received at signup, and receives the client's redirect URL with an authorization code. Credentials a person issued from the dashboard are refused. The resulting connection ends when that credential is revoked, expires, or the human declines the account. ## OpenAPI ````yaml /api-reference/openapi.json post /credits/mcp/oauth/authorize/agent-credential openapi: 3.1.0 info: title: Locus Pro API description: >- Access paid tools, manage prepaid balances, and build usage billing. Send money as exact decimal strings and reuse Idempotency-Key on retries. Management routes require a scoped server key or authorized dashboard session. Sensitive workspace changes require an owner or admin with recent MFA or passkey verification, except where an operation documents a stricter boundary. Interactive agents use MCP OAuth; unattended agents use scoped Agent Connections. Browser widgets use end-user tokens. version: 0.7.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: Feature-gated enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Customers description: >- Names for the customers a tenant attributes spend to, and every customer's spend - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Feature-gated Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Hosted Workflows description: >- Tenant-private TypeScript Workflow definitions, immutable versions, bounded runs, artifacts, and recovery - name: Resources description: >- Durable resources an agent bought, such as phone numbers, inboxes and sandboxes - name: Tasks description: >- Delegate a multi-step outcome to Locus with one goal string. Locus compiles an acceptance contract, discovers and calls enabled catalog capabilities with the caller's own credits and spending controls, checks every returned value against stored provider evidence, and returns structured results, files, requirement statuses, and settled cost. Enabled when the deployment sets LOCUS_TASKS_ENABLED. - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Recipes description: >- Search, research, extraction, enrichment, and travel outcomes across providers paths: /credits/mcp/oauth/authorize/agent-credential: post: tags: - MCP summary: Approve a pending MCP authorization with the agent's own credential description: >- For an agent that created its own workspace (POST /credits/agent/signup or /credits/agent/register). The agent sends the lmo_req_ handle from its MCP client's authorization redirect with the lcac_ credential it received at signup, and receives the client's redirect URL with an authorization code. Credentials a person issued from the dashboard are refused. The resulting connection ends when that credential is revoked, expires, or the human declines the account. operationId: postCreditsMcpOauthAuthorizeAgentCredential requestBody: required: true content: application/json: schema: type: object additionalProperties: false required: - request properties: request: type: string pattern: ^lmo_req_[A-Za-z0-9_-]{43}$ responses: '200': description: >- Approved; deliver redirectUrl to the waiting MCP client exactly as returned '400': description: Authorization request is malformed, expired, or already used content: application/json: schema: $ref: '#/components/schemas/McpOAuthError' '403': description: Not the credential the agent received when it created its workspace content: application/json: schema: $ref: '#/components/schemas/McpOAuthError' '409': description: Connection limit reached or request already resolved content: application/json: schema: $ref: '#/components/schemas/McpOAuthError' security: - agentConnection: [] components: schemas: McpOAuthError: type: object required: - error properties: error: type: string description: OAuth protocol error code. error_description: type: string additionalProperties: false securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. agentConnection: type: http scheme: bearer description: >- Scoped lcac_ credential. Tenant-managed Agent Connections authorize only their bound MCP and wrapped execution surfaces. A bootstrap connection for a self-registered agent additionally authorizes the explicit /credits/agent/* self-service routes for its own account; neither form authorizes general tenant management. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.