curl --request POST \
--url https://api.paywithlocus.com/api/credits/okibi/cli-credential \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"registrationToken": "<string>"
}
'import requests
url = "https://api.paywithlocus.com/api/credits/okibi/cli-credential"
payload = { "registrationToken": "<string>" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({registrationToken: '<string>'})
};
fetch('https://api.paywithlocus.com/api/credits/okibi/cli-credential', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.paywithlocus.com/api/credits/okibi/cli-credential",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'registrationToken' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.paywithlocus.com/api/credits/okibi/cli-credential"
payload := strings.NewReader("{\n \"registrationToken\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.paywithlocus.com/api/credits/okibi/cli-credential")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"registrationToken\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.paywithlocus.com/api/credits/okibi/cli-credential")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"registrationToken\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"created": true,
"rotated": true,
"account": {
"email": "[email protected]",
"passwordSetupPending": true
},
"connection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "active",
"keyPrefix": "<string>",
"tools": {
"enable": [
"<string>"
]
},
"expiresAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z",
"credential": "<string>"
},
"storage": {
"environmentVariable": "LOCUS_SECRET_KEY",
"instruction": "<string>"
}
}{
"success": true,
"created": true,
"rotated": true,
"account": {
"email": "[email protected]",
"passwordSetupPending": true
},
"connection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "active",
"keyPrefix": "<string>",
"tools": {
"enable": [
"<string>"
]
},
"expiresAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z",
"credential": "<string>"
},
"storage": {
"environmentVariable": "LOCUS_SECRET_KEY",
"instruction": "<string>"
}
}Bootstrap a scoped Locus CLI credential from Okibi Identity
Exchanges a verified Okibi identity grant for one Locus lcac_ execution credential bound to the Okibi identity, CLI installation, and selected workspace. The credential expires 7 days after its last use and never later than 30 days after issue; every bootstrap issues it fresh for 7 days. Generate registrationToken locally from exactly 24 random bytes encoded as unpadded base64url. Replaying the token renews the installation’s credential unchanged; a new token rotates that credential in place (same connection, new secret and prefix). A revoked credential is never renewed or rotated. When tools is present the server enables exactly those catalog slugs and restricts the credential to them; when it is omitted the credential may use every endpoint the workspace has enabled, and a fresh bootstrap may replace or lift an existing allowlist. The token is never stored; Locus stores only the derived credential hash.
curl --request POST \
--url https://api.paywithlocus.com/api/credits/okibi/cli-credential \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"registrationToken": "<string>"
}
'import requests
url = "https://api.paywithlocus.com/api/credits/okibi/cli-credential"
payload = { "registrationToken": "<string>" }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({registrationToken: '<string>'})
};
fetch('https://api.paywithlocus.com/api/credits/okibi/cli-credential', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.paywithlocus.com/api/credits/okibi/cli-credential",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'registrationToken' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.paywithlocus.com/api/credits/okibi/cli-credential"
payload := strings.NewReader("{\n \"registrationToken\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.paywithlocus.com/api/credits/okibi/cli-credential")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"registrationToken\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.paywithlocus.com/api/credits/okibi/cli-credential")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"registrationToken\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"created": true,
"rotated": true,
"account": {
"email": "[email protected]",
"passwordSetupPending": true
},
"connection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "active",
"keyPrefix": "<string>",
"tools": {
"enable": [
"<string>"
]
},
"expiresAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z",
"credential": "<string>"
},
"storage": {
"environmentVariable": "LOCUS_SECRET_KEY",
"instruction": "<string>"
}
}{
"success": true,
"created": true,
"rotated": true,
"account": {
"email": "[email protected]",
"passwordSetupPending": true
},
"connection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "active",
"keyPrefix": "<string>",
"tools": {
"enable": [
"<string>"
]
},
"expiresAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z",
"credential": "<string>"
},
"storage": {
"environmentVariable": "LOCUS_SECRET_KEY",
"instruction": "<string>"
}
}Authorizations
Short-lived capability injected only by an Identity-eligible signed Okibi CLI release. It is verified by @okibi/partner-kit for issuer, audience, installation, grant activity, and required route scopes. Never persist or copy it into native Locus configuration.
Body
Canonical base64url encoding of 24 bytes generated by a cryptographically secure random-number generator.
^[A-Za-z0-9_-]{32}$Optional endpoint allowlist. Omit it to leave the credential unrestricted within the workspace's enabled endpoints.
Show child attributes
Show child attributes
Response
Existing credential renewed (same token) or rotated in place (new token); rotated tells which
True when this bootstrap created the installation's credential (HTTP 201).
True when a new registration token replaced the existing credential's secret in place (HTTP 200).
The Locus user behind the Okibi identity link. Locus provisions an account for an Okibi-verified email that has none; that account keeps a managed password until the person sets one through the emailed link or the dashboard's first screen.
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Show child attributes