Skip to main content
POST
Bootstrap a scoped Locus CLI credential from Okibi Identity

Authorizations

Authorization
string
header
required

Short-lived capability injected only by an Identity-eligible signed Okibi CLI release. It is verified by @okibi/partner-kit for issuer, audience, installation, grant activity, and required route scopes. Never persist or copy it into native Locus configuration.

Body

application/json
registrationToken
string
required

Canonical base64url encoding of 24 bytes generated by a cryptographically secure random-number generator.

Pattern: ^[A-Za-z0-9_-]{32}$
tools
object

Optional endpoint allowlist. Omit it to leave the credential unrestricted within the workspace's enabled endpoints.

Response

Existing credential renewed (same token) or rotated in place (new token); rotated tells which

success
any
required
created
boolean
required

True when this bootstrap created the installation's credential (HTTP 201).

rotated
boolean
required

True when a new registration token replaced the existing credential's secret in place (HTTP 200).

account
object
required

The Locus user behind the Okibi identity link. Locus provisions an account for an Okibi-verified email that has none; that account keeps a managed password until the person sets one through the emailed link or the dashboard's first screen.

connection
object
required
storage
object
required