> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. # Dynamically register an MCP OAuth client > RFC 7591 registration for public native or web clients. Register authorization_code with validated redirect URIs, the RFC 8628 device-code grant without redirect URIs, or both. refresh_token is optional; offline_access is grantable only when it is registered. ## OpenAPI ````yaml /api-reference/openapi.json post /credits/mcp/oauth/register openapi: 3.1.0 info: title: Locus Pro API description: >- Production is live at https://api.paywithlocus.com/api. Stage remains available for evaluation and integration testing at https://api.stage.paywithlocus.com/api; credentials, balances, and tenant data are isolated by environment. Embedded prepaid credits over the Locus pay-per-use catalog. Money and top-up amounts use exact decimal strings (up to 6dp). Every burn requires an Idempotency-Key header. Management routes accept a tenant secret key or authorized dashboard session as shown per operation. Widget routes accept an end-user JWT alone; when a publishable key is present it must belong to the JWT's tenant. MCP uses OAuth 2.1 Authorization Code with PKCE by default and also accepts the explicitly documented tenant secret key, end-user JWT, or scoped agent connection compatibility credentials. Burns accept the execution credentials shown per operation. Publishable keys never authorize management or burns by themselves. version: 0.6.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: >- Available when enabled for the workspace. Enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: Travel routing description: >- Available when enabled for the workspace. Multi-provider flight search, no-dispatch planning, and feedback - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Available when enabled for the workspace. Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Capability routing description: Outcome-level web search and research across eligible catalog providers paths: /credits/mcp/oauth/register: post: tags: - MCP summary: Dynamically register an MCP OAuth client description: >- RFC 7591 registration for public native or web clients. Register authorization_code with validated redirect URIs, the RFC 8628 device-code grant without redirect URIs, or both. refresh_token is optional; offline_access is grantable only when it is registered. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/McpOAuthClientMetadata' responses: '201': description: Registered client and one-time registration access token content: application/json: schema: $ref: '#/components/schemas/McpOAuthClientRegistration' '400': description: Invalid client metadata content: application/json: schema: $ref: '#/components/schemas/McpOAuthError' '415': description: Content type must be application/json security: [] components: schemas: McpOAuthClientMetadata: type: object allOf: - anyOf: - not: required: - grant_types - required: - grant_types properties: grant_types: contains: const: authorization_code - required: - grant_types properties: grant_types: contains: const: urn:ietf:params:oauth:grant-type:device_code - if: anyOf: - not: required: - grant_types - required: - grant_types properties: grant_types: contains: const: authorization_code then: required: - redirect_uris properties: redirect_uris: minItems: 1 response_types: minItems: 1 maxItems: 1 else: properties: response_types: maxItems: 0 properties: client_name: type: string maxLength: 120 application_type: type: string enum: - native - web redirect_uris: type: array minItems: 0 maxItems: 10 uniqueItems: true items: type: string format: uri description: >- Required and non-empty when grant_types contains authorization_code; may be empty for a device-only client. grant_types: type: array minItems: 1 maxItems: 3 uniqueItems: true items: type: string enum: - authorization_code - refresh_token - urn:ietf:params:oauth:grant-type:device_code default: - authorization_code description: >- Must contain authorization_code or the device-code grant. refresh_token may accompany either. response_types: type: array minItems: 0 maxItems: 1 uniqueItems: true items: type: string const: code description: >- Exactly ["code"] for authorization_code clients and [] for device-only clients. token_endpoint_auth_method: type: string const: none client_uri: type: string format: uri logo_uri: type: string format: uri additionalProperties: true McpOAuthClientRegistration: allOf: - $ref: '#/components/schemas/McpOAuthClientMetadata' - type: object required: - client_id - client_id_issued_at - client_name - application_type - redirect_uris - grant_types - response_types - token_endpoint_auth_method - registration_client_uri properties: client_id: type: string client_id_issued_at: type: integer registration_client_uri: type: string format: uri registration_access_token: type: string description: >- Returned only when the client is created; show and store it once. McpOAuthError: type: object required: - error properties: error: type: string description: OAuth protocol error code. error_description: type: string additionalProperties: false securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. ````