> ## Documentation Index > Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt > Use this file to discover all available pages before exploring further. # Bootstrap a scoped Locus CLI credential from Okibi Identity > Exchanges a verified Okibi identity grant for one 24-hour Locus lcac_ execution credential bound to the Okibi identity, CLI installation, selected workspace, and explicit provider/endpoint allowlist. The server enables only those catalog slugs. Generate registrationToken locally from exactly 24 random bytes encoded as unpadded base64url and replay the same token to recover or renew the credential without Locus sign-in. A fresh verified bootstrap may replace that credential's endpoint allowlist. The token is never stored; Locus stores only the derived credential hash. A different token cannot take over an existing installation binding. ## OpenAPI ````yaml /api-reference/openapi.json post /credits/okibi/cli-credential openapi: 3.1.0 info: title: Locus Pro API description: >- Production is live at https://api.paywithlocus.com/api. Stage remains available for evaluation and integration testing at https://api.stage.paywithlocus.com/api; credentials, balances, and tenant data are isolated by environment. Embedded prepaid credits over the Locus pay-per-use catalog. Money and top-up amounts use exact decimal strings (up to 6dp). Every burn requires an Idempotency-Key header. Management routes accept a tenant secret key or authorized dashboard session as shown per operation. Widget routes accept an end-user JWT alone; when a publishable key is present it must belong to the JWT's tenant. MCP uses OAuth 2.1 Authorization Code with PKCE by default and also accepts the explicitly documented tenant secret key, end-user JWT, or scoped agent connection compatibility credentials. Burns accept the execution credentials shown per operation. Publishable keys never authorize management or burns by themselves. version: 0.6.0 servers: - url: https://api.paywithlocus.com/api description: Production - url: https://api.stage.paywithlocus.com/api description: Stage — evaluation and integration testing security: - secretKey: [] tags: - name: Authentication description: Email-verified self-serve account creation and dashboard identity - name: Tenants description: Tenant profile, keys, and settings (dashboard session or secret key) - name: Workspace members description: Invite-only human workspace membership and role administration - name: Catalog description: Enable/disable APIs and set markups - name: Custom APIs description: >- Available when enabled for the workspace. Enterprise BYOK providers and schema-backed custom actions - name: End users description: End-user accounts, tokens, and allocations - name: Top-ups description: Locus-hosted checkout top-ups and quotes - name: Ledger description: Burn/top-up history and earnings - name: Webhooks description: Signed events, delivery inspection, and replay - name: Burn description: Metered pay-per-use calls - name: Travel routing description: >- Available when enabled for the workspace. Multi-provider flight search, no-dispatch planning, and feedback - name: MCP description: Stateless Streamable HTTP transport and MCP tool-result contracts - name: Okibi Identity description: >- Available when enabled for the workspace. Okibi identity verification and scoped native CLI credential bootstrap - name: Widget description: End-user JWT surface; a matching publishable key is optional - name: Agent-native onboarding description: >- Self-registration, human Stripe funding handoff, and restricted account setup for headless agents - name: Agent connections description: Scoped, expiring, revocable credentials for agent execution - name: Capability routing description: Outcome-level web search and research across eligible catalog providers paths: /credits/okibi/cli-credential: post: tags: - Okibi Identity summary: Bootstrap a scoped Locus CLI credential from Okibi Identity description: >- Exchanges a verified Okibi identity grant for one 24-hour Locus lcac_ execution credential bound to the Okibi identity, CLI installation, selected workspace, and explicit provider/endpoint allowlist. The server enables only those catalog slugs. Generate registrationToken locally from exactly 24 random bytes encoded as unpadded base64url and replay the same token to recover or renew the credential without Locus sign-in. A fresh verified bootstrap may replace that credential's endpoint allowlist. The token is never stored; Locus stores only the derived credential hash. A different token cannot take over an existing installation binding. requestBody: required: true content: application/json: schema: type: object additionalProperties: false required: - registrationToken - tools properties: registrationToken: $ref: '#/components/schemas/AgentRegistrationToken' tools: type: object additionalProperties: false required: - enable properties: enable: type: array minItems: 1 maxItems: 200 uniqueItems: true items: type: string pattern: ^[^/\s]+/[^/\s]+$ description: >- Exact provider/endpoint catalog slug, for example apollo/people-search. responses: '200': description: Existing credential recovered or renewed content: application/json: schema: $ref: '#/components/schemas/OkibiCliCredentialEnvelope' '201': description: New scoped native credential created content: application/json: schema: $ref: '#/components/schemas/OkibiCliCredentialEnvelope' '400': description: Invalid registration token, empty endpoint scope, or unknown field '401': description: Missing, invalid, expired, or inactive Okibi capability '403': description: Missing mcp:read/mcp:execute or inactive Locus membership '404': description: Unknown provider/endpoint catalog slug '409': description: >- The installation is bound to a different token, changed concurrently, or its native credential was revoked security: - okibiIdentity: [] components: schemas: AgentRegistrationToken: type: string pattern: ^[A-Za-z0-9_-]{32}$ description: >- Canonical base64url encoding of 24 bytes generated by a cryptographically secure random-number generator. OkibiCliCredentialEnvelope: type: object additionalProperties: false required: - success - created - connection - storage properties: success: const: true created: type: boolean connection: type: object additionalProperties: false required: - id - status - keyPrefix - tools - expiresAt - lastUsedAt - credential properties: id: type: string format: uuid status: type: string enum: - active - expired - revoked keyPrefix: type: string description: Non-secret display prefix. tools: type: object additionalProperties: false required: - enable properties: enable: type: array items: type: string expiresAt: type: string format: date-time lastUsedAt: oneOf: - type: string format: date-time - type: 'null' credential: type: string pattern: ^lcac_ readOnly: true description: Raw scoped Locus credential. Capture once and never log it. storage: type: object additionalProperties: false required: - environmentVariable - instruction properties: environmentVariable: const: LOCUS_SECRET_KEY instruction: type: string securitySchemes: secretKey: type: http scheme: bearer description: Tenant secret key (lcr_…). Server-side only. okibiIdentity: type: http scheme: bearer bearerFormat: Okibi capability description: >- Short-lived capability injected only by an Identity-eligible signed Okibi CLI release. It is verified by @okibi/partner-kit for issuer, audience, installation, grant activity, and required route scopes. Never persist or copy it into native Locus configuration. ````