curl --request POST \
--url https://api.paywithlocus.com/api/credits/okibi/cli-credential \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"registrationToken": "<string>",
"tools": {
"enable": [
"<string>"
]
}
}
'import requests
url = "https://api.paywithlocus.com/api/credits/okibi/cli-credential"
payload = {
"registrationToken": "<string>",
"tools": { "enable": ["<string>"] }
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({registrationToken: '<string>', tools: {enable: ['<string>']}})
};
fetch('https://api.paywithlocus.com/api/credits/okibi/cli-credential', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.paywithlocus.com/api/credits/okibi/cli-credential",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'registrationToken' => '<string>',
'tools' => [
'enable' => [
'<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.paywithlocus.com/api/credits/okibi/cli-credential"
payload := strings.NewReader("{\n \"registrationToken\": \"<string>\",\n \"tools\": {\n \"enable\": [\n \"<string>\"\n ]\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.paywithlocus.com/api/credits/okibi/cli-credential")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"registrationToken\": \"<string>\",\n \"tools\": {\n \"enable\": [\n \"<string>\"\n ]\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.paywithlocus.com/api/credits/okibi/cli-credential")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"registrationToken\": \"<string>\",\n \"tools\": {\n \"enable\": [\n \"<string>\"\n ]\n }\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"created": true,
"connection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "active",
"keyPrefix": "<string>",
"tools": {
"enable": [
"<string>"
]
},
"expiresAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z",
"credential": "<string>"
},
"storage": {
"environmentVariable": "LOCUS_SECRET_KEY",
"instruction": "<string>"
}
}{
"success": true,
"created": true,
"connection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "active",
"keyPrefix": "<string>",
"tools": {
"enable": [
"<string>"
]
},
"expiresAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z",
"credential": "<string>"
},
"storage": {
"environmentVariable": "LOCUS_SECRET_KEY",
"instruction": "<string>"
}
}Bootstrap a scoped Locus CLI credential from Okibi Identity
Exchanges a verified Okibi identity grant for one 24-hour Locus lcac_ execution credential bound to the Okibi identity, CLI installation, selected workspace, and explicit provider/endpoint allowlist. The server enables only those catalog slugs. Generate registrationToken locally from exactly 24 random bytes encoded as unpadded base64url and replay the same token to recover or renew the credential without Locus sign-in. A fresh verified bootstrap may replace that credential’s endpoint allowlist. The token is never stored; Locus stores only the derived credential hash. A different token cannot take over an existing installation binding.
curl --request POST \
--url https://api.paywithlocus.com/api/credits/okibi/cli-credential \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"registrationToken": "<string>",
"tools": {
"enable": [
"<string>"
]
}
}
'import requests
url = "https://api.paywithlocus.com/api/credits/okibi/cli-credential"
payload = {
"registrationToken": "<string>",
"tools": { "enable": ["<string>"] }
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({registrationToken: '<string>', tools: {enable: ['<string>']}})
};
fetch('https://api.paywithlocus.com/api/credits/okibi/cli-credential', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.paywithlocus.com/api/credits/okibi/cli-credential",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'registrationToken' => '<string>',
'tools' => [
'enable' => [
'<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.paywithlocus.com/api/credits/okibi/cli-credential"
payload := strings.NewReader("{\n \"registrationToken\": \"<string>\",\n \"tools\": {\n \"enable\": [\n \"<string>\"\n ]\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.paywithlocus.com/api/credits/okibi/cli-credential")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"registrationToken\": \"<string>\",\n \"tools\": {\n \"enable\": [\n \"<string>\"\n ]\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.paywithlocus.com/api/credits/okibi/cli-credential")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"registrationToken\": \"<string>\",\n \"tools\": {\n \"enable\": [\n \"<string>\"\n ]\n }\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"created": true,
"connection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "active",
"keyPrefix": "<string>",
"tools": {
"enable": [
"<string>"
]
},
"expiresAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z",
"credential": "<string>"
},
"storage": {
"environmentVariable": "LOCUS_SECRET_KEY",
"instruction": "<string>"
}
}{
"success": true,
"created": true,
"connection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "active",
"keyPrefix": "<string>",
"tools": {
"enable": [
"<string>"
]
},
"expiresAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z",
"credential": "<string>"
},
"storage": {
"environmentVariable": "LOCUS_SECRET_KEY",
"instruction": "<string>"
}
}Authorizations
Short-lived capability injected only by an Identity-eligible signed Okibi CLI release. It is verified by @okibi/partner-kit for issuer, audience, installation, grant activity, and required route scopes. Never persist or copy it into native Locus configuration.