Skip to main content
Every request to Locus Pro carries a credential, and each credential gets only the access it needs. Scopes and roles set that access. The keys and roles here are Locus Pro Enterprise features; for self-serve setup, see Connect your agent.

​
How it works

Your server holds the most powerful credential, a secret key, and it never leaves your server. Everything else gets something narrower: agents get agent keys, customers’ browsers get short-lived end-user tokens that your server mints, and MCP clients sign in with OAuth as a team member.

​
Choose a credential

API keys helps you pick one, and Key lifecycle covers creating, rotating, and revoking them.

​
Enterprise management scopes

Scopes decide which management actions a secret key can take. Give each key only the ones it needs:
  • Read the workspace: tenant:read covers workspace, catalog, balance, usage, ledger, and billing reads.
  • Change settings and the catalog: tenant:write and catalog:write.
  • Spend and move credits: credits:move covers metered calls, top-ups, and allocations.
  • Manage credentials: credentials:manage for keys and tokens:manage for end-user tokens and policies.
  • Manage payouts and people: payouts:manage and members:manage.
A secret key bound to a tool set, or given an allowed-tools list or its own pricing, is execution-only. It calls tools and reads balances but can’t use the management API.

​
Scopes and roles work together

Scopes don’t override workspace roles. Sensitive changes, including key lifecycle, membership, spend controls, and payout settings, require a workspace owner or admin with recent MFA or passkey verification. An API key can’t satisfy that requirement. Custom API changes, plan changes, and ownership transfer are owner-only. A server key can still automate agent keys; see Automate agent keys.

​
Enterprise workspace roles and invitations

Each member has one role: Owner, Admin, Developer, Billing, or Viewer. Each workspace has exactly one owner. An owner or admin can invite members from Team. Invitations expire after seven days. Team access needs an Enterprise plan, an active Enterprise trial, or a signed agreement. See Team and roles for what each role can do and how to transfer ownership.

​
Check access

Ask Locus what the current credential can do. The response shows its scopes and role, never the secret:

​
When access is denied

Retrying a refused request won’t fix missing access. Check, in order:
  1. The credential: is it the right kind, unexpired, and not revoked?
  2. The scope: does the key have the scope the action needs?
  3. The person: sensitive changes need an owner or admin with recent verification, and some need the owner.
  4. The plan: Enterprise features need an Enterprise plan, trial, or agreement. The owner can choose one under Billing → Plans.
The API reference lists each route’s requirements.

​
Next steps

API keys

Pick the right key for each place your code runs.

Team and roles

Invite members and choose what each can do.