curl --request POST \
--url https://api.paywithlocus.com/api/credits/mcp \
--header 'Accept: <accept>' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"jsonrpc": "2.0",
"id": "list-1",
"method": "tools/list",
"params": {}
}
'{
"jsonrpc": "2.0",
"id": "<string>",
"result": {
"content": [
{
"type": "text",
"text": "<string>"
}
],
"isError": false,
"structuredContent": {},
"_meta": {
"locus/status": 349,
"locus/creditsCharged": "<string>",
"locus/creditsBalance": "<string>",
"locus/costUsd": "<string>",
"locus/idempotencyKey": "<string>",
"locus/approvalId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"locus/maxChargeCredits": "<string>",
"locus/reapprovalRequired": true,
"locus/artifact": {
"uri": "<string>",
"mime_type": "<string>",
"byte_size": 1,
"sha256": "<string>",
"filename": "<string>",
"disposition": "inline",
"expires_at": "2023-11-07T05:31:56Z"
},
"locus/presentation": {
"providerName": "<string>",
"actionName": "<string>",
"category": "<string>",
"description": "<string>",
"logoUrl": "<string>",
"fallback": {
"type": "monogram",
"text": "<string>"
},
"assetVersion": "1",
"cacheControl": "public, max-age=86400",
"presentationOnly": true
}
}
}
}{
"jsonrpc": "2.0",
"id": "<string>",
"error": {
"code": 123,
"message": "<string>",
"data": "<unknown>"
}
}{
"jsonrpc": "2.0",
"id": "<string>",
"error": {
"code": 123,
"message": "<string>",
"data": "<unknown>"
}
}{
"jsonrpc": "2.0",
"id": "<string>",
"error": {
"code": 123,
"message": "<string>",
"data": "<unknown>"
}
}{
"jsonrpc": "2.0",
"id": "<string>",
"error": {
"code": 123,
"message": "<string>",
"data": "<unknown>"
}
}{
"success": false,
"error": "Payload too large",
"code": "REQUEST_BODY_TOO_LARGE",
"limitBytes": 4194304
}{
"jsonrpc": "2.0",
"id": "<string>",
"error": {
"code": 123,
"message": "<string>",
"data": "<unknown>"
}
}Hosted MCP server (stateless Streamable HTTP)
One MCP JSON-RPC request per POST, with an encoded JSON body limit of 4 MiB. OAuth 2.1 is the primary authentication path: initialize, discovery, and resource reads require mcp:read, while billed tools/call execution additionally requires mcp:execute. Tenant secret keys, end-user JWTs, and scoped agent connections remain compatibility credentials. This transport is stateless: it issues no MCP-Session-Id, retains no resumable SSE stream, and recomputes the authenticated tenant catalog on every request. For tools/call, inspect result.isError even when HTTP and JSON-RPC both succeeded.
curl --request POST \
--url https://api.paywithlocus.com/api/credits/mcp \
--header 'Accept: <accept>' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"jsonrpc": "2.0",
"id": "list-1",
"method": "tools/list",
"params": {}
}
'{
"jsonrpc": "2.0",
"id": "<string>",
"result": {
"content": [
{
"type": "text",
"text": "<string>"
}
],
"isError": false,
"structuredContent": {},
"_meta": {
"locus/status": 349,
"locus/creditsCharged": "<string>",
"locus/creditsBalance": "<string>",
"locus/costUsd": "<string>",
"locus/idempotencyKey": "<string>",
"locus/approvalId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"locus/maxChargeCredits": "<string>",
"locus/reapprovalRequired": true,
"locus/artifact": {
"uri": "<string>",
"mime_type": "<string>",
"byte_size": 1,
"sha256": "<string>",
"filename": "<string>",
"disposition": "inline",
"expires_at": "2023-11-07T05:31:56Z"
},
"locus/presentation": {
"providerName": "<string>",
"actionName": "<string>",
"category": "<string>",
"description": "<string>",
"logoUrl": "<string>",
"fallback": {
"type": "monogram",
"text": "<string>"
},
"assetVersion": "1",
"cacheControl": "public, max-age=86400",
"presentationOnly": true
}
}
}
}{
"jsonrpc": "2.0",
"id": "<string>",
"error": {
"code": 123,
"message": "<string>",
"data": "<unknown>"
}
}{
"jsonrpc": "2.0",
"id": "<string>",
"error": {
"code": 123,
"message": "<string>",
"data": "<unknown>"
}
}{
"jsonrpc": "2.0",
"id": "<string>",
"error": {
"code": 123,
"message": "<string>",
"data": "<unknown>"
}
}{
"jsonrpc": "2.0",
"id": "<string>",
"error": {
"code": 123,
"message": "<string>",
"data": "<unknown>"
}
}{
"success": false,
"error": "Payload too large",
"code": "REQUEST_BODY_TOO_LARGE",
"limitBytes": 4194304
}{
"jsonrpc": "2.0",
"id": "<string>",
"error": {
"code": 123,
"message": "<string>",
"data": "<unknown>"
}
}Authorizations
Primary authentication for the hosted MCP resource. Public clients use Authorization Code with PKCE S256. mcp:read covers discovery and resource reads; billed tools/call additionally requires mcp:execute; offline_access requests a rotating refresh token.
Headers
Required only when the end-user JWT carries sid. Send the original high-entropy session value; sid is its SHA-256 fingerprint. Ignored for secret-key authentication.
16 - 128^[A-Za-z0-9][A-Za-z0-9._:-]{15,127}$Negotiated MCP version on requests after initialize. The server also accepts 2025-03-26 clients.
"2025-06-18"
Streamable HTTP clients advertise both media types. This stateless server returns application/json.
"application/json, text/event-stream"
Body
Response
JSON-RPC success or protocol error. A tools/call application failure is a success envelope whose result.isError is true.