> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. # Read signed-in device consent context > Returns the selected account, grantable scopes, connection capacity, resource, and expiry immediately before a human approves or denies the device. Requested scopes may be reduced to the member's effective authority. ## OpenAPI ````yaml /api-reference/openapi.json get /credits/mcp/oauth/device/context openapi: 3.1.0 info: title: Locus Pro API description: >- Production is live at https://api.paywithlocus.com/api. Stage remains available for evaluation and integration testing at https://api.stage.paywithlocus.com/api; credentials, balances, and tenant data are isolated by environment. Embedded prepaid credits over the Locus pay-per-use catalog. Money and top-up amounts use exact decimal strings (up to 6dp). Every burn requires an Idempotency-Key header. Management routes accept a tenant secret key or authorized dashboard session as shown per operation. Widget routes accept an end-user JWT alone; when a publishable key is present it must belong to the JWT's tenant. MCP uses OAuth 2.1 Authorization Code with PKCE by default and also accepts the explicitly documented tenant secret key, end-user JWT, or scoped agent connection compatibility credentials. Burns accept the execution credentials shown per operation. Publishable keys never authorize management or burns by themselves. version: 0.6.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: >- Available when enabled for the workspace. Enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: Travel routing description: >- Available when enabled for the workspace. Multi-provider flight search, no-dispatch planning, and feedback - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Available when enabled for the workspace. Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Capability routing description: Outcome-level web search and research across eligible catalog providers paths: /credits/mcp/oauth/device/context: get: tags: - MCP summary: Read signed-in device consent context description: >- Returns the selected account, grantable scopes, connection capacity, resource, and expiry immediately before a human approves or denies the device. Requested scopes may be reduced to the member's effective authority. parameters: - $ref: '#/components/parameters/McpDeviceUserCodeQuery' - $ref: '#/components/parameters/LocusTenantSelectionHeader' responses: '200': description: Device consent context headers: Cache-Control: schema: const: no-store content: application/json: schema: $ref: '#/components/schemas/McpOAuthDeviceContextResponse' '400': description: >- Invalid/expired user code, invalid account selection, or missing signed-in user '401': description: Dashboard session required '403': description: Selected membership is unavailable '409': description: >- The user belongs to multiple workspaces and the request omits X-Locus-Tenant-Id. content: application/json: schema: type: object required: - error properties: error: type: string error_description: type: string '429': description: Too many verification attempts security: - dashboardSession: [] components: parameters: McpDeviceUserCodeQuery: name: user_code in: query required: true schema: $ref: '#/components/schemas/McpOAuthDeviceUserCodeInput' description: >- Eight-character device user code. Input is case-insensitive; non-alphanumeric punctuation is ignored and the value is normalized to XXXX-XXXX. LocusTenantSelectionHeader: name: X-Locus-Tenant-Id in: header required: false schema: type: string format: uuid description: >- Explicit account selection for a signed-in identity with multiple active memberships. schemas: McpOAuthDeviceContextResponse: type: object additionalProperties: false required: - success - data properties: success: const: true data: type: object additionalProperties: false required: - userCode - clientName - clientId - tenantName - scopes - scopeReduced - connectionCapacity - resource - expiresAt properties: userCode: $ref: '#/components/schemas/McpOAuthDeviceUserCode' clientName: type: string clientId: type: string tenantName: type: string scopes: type: array items: type: string enum: - mcp:read - mcp:execute - offline_access scopeReduced: type: boolean connectionCapacity: $ref: '#/components/schemas/McpConnectionCapacity' resource: type: string format: uri expiresAt: type: string format: date-time McpOAuthDeviceUserCodeInput: type: string pattern: >- ^[^A-Za-z0-9]*[A-HJ-NP-Za-hj-np-z2-9](?:[^A-Za-z0-9]*[A-HJ-NP-Za-hj-np-z2-9]){7}[^A-Za-z0-9]*$ description: >- Case-insensitive device-code input. Locus ignores non-alphanumeric punctuation, rejects ambiguous characters, and normalizes the eight significant characters to XXXX-XXXX. McpOAuthDeviceUserCode: type: string pattern: ^[A-HJ-NP-Z2-9]{4}-[A-HJ-NP-Z2-9]{4}$ description: >- Human-readable code that omits ambiguous characters. Display it exactly as returned. McpConnectionCapacity: type: object additionalProperties: false required: - plan - limit - active - reserved - remaining properties: plan: type: string enum: - free - plus - unlimited limit: type: - integer - 'null' minimum: 1 description: Null for an unlimited plan or enterprise workspace. active: type: integer minimum: 0 reserved: type: integer minimum: 0 description: >- Approved browser and device grants that have not yet been exchanged and have not expired. remaining: type: - integer - 'null' minimum: 0 securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. dashboardSession: type: http scheme: bearer description: Locus Pro dashboard session (Cognito). ````