Choose authorization
Personal accounts manage OAuth clients under Connections. Included supports one active OAuth-connected client, Plus supports three, and Unlimited removes the cap. Capacity includes active grants and approved browser or device authorizations that have not exchanged their code yet. Retrying with the same client replaces its unfinished authorization. Browser reservations last 20 minutes; device reservations last 15 minutes. Enterprise users configure interactive clients under Integrate; trusted servers can issue endpoint- and budget-scoped service credentials.
Enterprise service credentials
What an agent connection is
An agent connection is not another kind of API key. It is a saved setup for one agent: which credit account it spends from, which endpoints it may call, which end-user pricing overrides apply, how much it may spend per call and per run, and when its access ends. Creating one returns a matchinglcac_… credential, and that credential can only ever act
inside the setup it was issued for.
The name follows from what you get back. You are not handed only a token to go
configure a client with — you are handed the finished connection, MCP URL and
header included:
Agent connection or tenant secret key?
Both can authenticate a metered call, which is the usual source of confusion. They are not interchangeable, and only one of them belongs in an agent.
Both are bounded by the tenant catalog, and either credential can narrow
endpoints. An Agent Connection additionally fixes the spending account and can
set per-call and per-run ceilings. Creating, rotating, or revoking keys;
managing members; and other owner-and-step-up operations require the workspace
owner’s dashboard session, not a tenant key.
The secret key appears exactly once in this flow: you use it to create the
connection. After that the agent holds only the
lcac_… credential and the
secret key stays on your server.
Install the Locus plugin
The Locus plugin configures the hosted MCP server and installs the Locus skills in one step on Claude Code, Codex, and Grok. OpenClaw installs the same plugin and adds the server with one MCP command; Cursor connects through the MCP client tabs further down this page until its marketplace listing is live.- Claude Code
- Codex
- Grok
- OpenClaw
- Cursor
/mcp, select locus, and choose Authenticate.locus and authenticates
with interactive OAuth. If you previously added the same server manually as
locus-pro using OAuth, remove that entry so the client keeps a single
connection. Keep any manual entry that carries an enterprise service
credential: the plugin never replaces credential-based configuration, so on
that path use the manual setup in
enterprise service-credential configuration
instead of the plugin’s connection, or the client will expose duplicate
tools.
Give your coding agent the Locus skills
The plugin above already bundles the samelocus and locus-setup skills
this command installs — run this step only for an agent where you skipped
the plugin, and use one source per agent so they are not installed twice:
Choose a connection method
All methods reach the same catalog, pricing engine, ledger, endpoint policy, and reservation and refund path. MCP adds tool discovery and schemas. The SDK and REST path give your application direct control over each call.
The official CLI installer is
https://okibi.ai/i/locus/locus. The signed
release includes its command reference and an agent skill, so install the CLI
as one artifact instead of copying generated instructions separately. The
repo-backed release targets the production Locus Pro API by default; use an
explicit profile only when intentionally connecting to an isolated stage or
local environment.
Set up an enterprise service credential
1
Enable the tenant catalog
Enable the provider endpoints your application is allowed to offer. A connection can narrow this catalog, but it cannot re-enable a tenant-disabled endpoint.
2
Create a scoped connection
Choose the pooled platform account or one immutable end-user account. Pin the required
provider/endpoint slugs, optionally set end-user pricing overrides, and set an expiry plus per-call and per-loop limits.3
Store the credential immediately
Locus returns the full
lcac_… credential only on create and rotate. Store it in your runtime’s secret manager or environment, never in source control.4
Connect and observe
Add the MCP configuration or use the credential with the SDK or REST path. Monitor status, expiry, and last use from the dashboard or API.
Create a connection
- SDK
- API
Connection scope and budgets
mode: "platform" draws from the tenant’s pooled balance at the base Locus price. mode: "end_user" requires one externalUserId and draws from only that end-user balance at the tenant’s effective price. Do not reuse one end-user connection across customers.
For an end-user connection, pricing can override the tenant pricing inherited
by that credential. Endpoint values outrank the connection default, which
outranks the tenant default; the workspace markup ceiling still applies:
@withlocus/credits 0.5.2 typed create helper does not accept
pricing; use the REST request or dashboard when you need a connection-level
price policy.
Omitting
tools inherits every endpoint currently enabled for the tenant.
Sending tools: { enable: [] } grants no provider endpoints. Built-in MCP
discovery and balance tools remain available, but execution is denied.maxCreditsPerLoop is set, reuse one loop ID for all paid calls in the same autonomous run:
X-Locus-Agent-Loop-Id. MCP callers pass loop_id to execute, or a nested _locus: { "loop_id": "…" } object to a dedicated endpoint tool. Concurrent reservations cannot race past the connection limit. Unused capacity is returned after capture or refund.
Connect an MCP client
Locus Pro exposes a hosted, stateless MCP server over Streamable HTTP:X-Source-Name for aggregate client telemetry. It never changes authentication, identity, or billing.
Interactive OAuth (recommended)
Use interactive OAuth for personal accounts and for a person-authorized enterprise client. In a personal account, open Connections and choose the client. In an enterprise workspace, open Integrate → MCP clients. Add the public MCP URL without an authorization header, then complete Locus sign-in and consent in the browser.- Codex
- Claude Code
- Cursor
- Other clients
Agent-owned headless OAuth
An activated agent-owned account uses the same MCP Authorization Code + PKCE flow without requiring a GUI browser. Keep the MCP login process and any loopback callback listener alive so the client retains its PKCE verifier. Follow the printed authorization URL, capture the opaquerequest=lmo_req_… value from the Locus consent URL, and request its safe signed-out context:
data.agentIdAuthorizationUrl, preserving the HTTP cookie that produced the AgentID request ID. Approve that exact 22-character ID with the inbox’s P-256 key, then fetch AgentID’s /v0/authorize/continue using the same cookie and follow every redirect. The canonical agent/auth.md reference defines the exact JWS and HTTP contract. Do not remove or rewrite the final code, state, or iss parameters.
The redirect returns to the callback URI registered by the MCP client. If a remote loopback callback is unreachable, use that client’s documented manual-code mode or SSH port forwarding. AgentID approval itself does not require a GUI; human involvement remains appropriate only for an AgentMail inbox OTP or the Stripe funding handoff.
Headless device authorization (RFC 8628)
A client that cannot receive an OAuth redirect can use the device-code grant. Register a device client once with dynamic client registration — the device grant must be requested ingrant_types, refresh_token alongside it keeps
the session renewable, and a device-only client omits redirect_uris
entirely:
verification_uri_complete or verification_uri and user_code to the user. While they approve, poll POST /api/credits/mcp/oauth/token with the returned device_code, client_id, MCP resource, and grant_type=urn:ietf:params:oauth:grant-type:device_code.
Wait at least the returned interval. Keep waiting on authorization_pending; add five seconds after slow_down; stop on a terminal error. The code expires after 15 minutes and can issue tokens once. A user who belongs to multiple workspaces must send X-Locus-Tenant-Id on the signed-in consent context and decision calls, or those return 409; the public-context fetch needs no tenant selection.
Enterprise service-credential configuration
For a truly unattended enterprise runtime, authenticate with the one-timelcac_… value from the Agent Connection response. The tabs below deliberately configure a bearer value and do not open an OAuth prompt.
- Codex
- Claude Code
- Cursor
- Claude Desktop
Put the credential in your environment:Add the server to Codex CLI, the Codex app, and the IDE extension share this configuration.
~/.codex/config.toml:OAuth behavior and token lifecycle
An interactive MCP client follows the server’s OAuth discovery flow without a pre-provisionedlcac_… credential. Codex uses codex mcp login; Claude Code starts the flow from /mcp; Cursor, VS Code, Gemini CLI, and ChatGPT expose it from their MCP connection UI. The person signs in to Locus Pro, chooses an account when necessary, and grants the requested scopes.
The normal grant is mcp:read mcp:execute offline_access. Read-only workspace members receive discovery-only access, and a deliberately read-only application can request mcp:read offline_access. Access tokens last 15 minutes; refresh tokens last up to 30 days and rotate on use. Revocation, removed membership, suspended workspaces, expired grants, and refresh-token reuse all fail closed.
OAuth is the default for a person-authorized desktop or application connection and for an agent-owned account using AgentID. An agent-owned account can complete its OAuth handoff browserlessly as described above. Enterprise workloads that need a fixed account, endpoint allowlist, expiry, and spend ceilings should use an Agent Connection. A tenant secret key remains a server-side fallback and never belongs in a desktop configuration.
Applications that own the redirect can use LocusMcpOAuth from @withlocus/credits for protected-resource and authorization-server discovery, PKCE, dynamic registration, callback validation, refresh rotation, and revocation. openAiMcpTool() builds the OpenAI MCP tool shape and defaults per-tool approval to never; opt into requireApproval only when your application deliberately wants another prompt.
Redirect URIs must be exact HTTPS URLs, loopback HTTP URLs for native clients, or RFC 8252 reverse-domain private-use URLs. Native loopback callbacks may vary only the listening port. Gemini CLI requires a local browser and callback listener, so use a service credential in a browserless container or SSH session.
Use the MCP tools
Every authenticated MCP session gets a compact built-in toolset plus the enabled endpoints allowed by its account and credential scope:
The server exposes only these meta-tools by default, whatever the catalog size; every visible endpoint is searchable and callable by slug through
execute. Execution-scoped sessions may additionally expose the enabled capability tools (router_web_search, web_research, travel_flights) automatically, and dedicated {provider}_{endpoint} tools appear for slugs you pin in the MCP URL query (?tool= / ?tools=), up to 20.
For OAuth, the visible catalog comes from the approved account and its enabled tools. For an Agent Connection, it is the intersection of the enterprise catalog and the connection’s immutable tool allowlist. Locus applies the effective scope to discovery, schemas, estimates, and execution. A stale or forged call returns an error before provider dispatch.
If search_apis returns no results, use its reason:
1
Discover
Call
search_apis or list_apis, then describe_api for the exact input schema.2
Estimate and approve
Call
estimate_cost when the action is dynamic, expensive, or sensitive.
Send expires_in_seconds when needed, then preserve the returned
approval_token and idempotency_key for execution.3
Execute
Call
execute (required when consuming an approval_token) or a dedicated endpoint tool for unapproved calls. Reuse one idempotency key across retries and one loop ID across the autonomous run.4
Read the result
Check
isError, then use the provider data, credits charged, and remaining balance. Non-streaming failures release their reservation automatically; MCP rejects streaming requests, so accepted-stream settlement applies only to REST inference calls.estimate_cost has one public approval contract. It accepts
expires_in_seconds from 30 through 600 (default 120) and returns approval_id,
approval_token, approval_mode, quoted_credits, max_charge_credits,
idempotency_key, and expires_at. Pass the unchanged approval_token,
arguments, and idempotency key to execute — only execute accepts an
approval token; dedicated endpoint tools cannot consume one.
If automatic chat inference and ask-before-use external tools share one agent
turn, use a bounded server policy for automatic inference and keep external
tool approval in your trusted application. The locus-pro agent skill contains
the complete two-connection reference flow. Native ask mode intentionally
requires approval for every paid execution, including chat inference.
Cancel an unused approval
When an approved call will not run — the plan changed or the quote will expire unused — release it withcancel_cost_approval:
cancel_cost_approval and execute take the approval_token;
approval_id is a reference for your logs and dashboard lookups, and no tool
accepts it as an argument.
Idempotency and replay
When you omitidempotency_key, the server derives one from the authenticated
principal’s tenant and bound user, the provider/endpoint, and the
canonicalized arguments, on a 60-second time bucket. The previous bucket is
also accepted, so the effective replay window is 60–120 seconds. Keys are
isolated to the paying account. Agent Connection keys are additionally scoped
to that connection, OAuth keys to the stable member/client pair, and end-user
accounts are already separate. Tenant secret keys intentionally share
account-wide idempotency so retries can survive key rotation.
A semantically identical call inside that window replays the original result
and receipt without a new charge. Replayed responses are marked with
locus/idempotentReplay: true in the result _meta and
idempotent_replay: true in the structured output, so you can tell a cache hit
from a fresh call.
Supplying your own idempotency_key makes the call replayable indefinitely
under that key; the time window applies only to server-derived keys. To
intentionally repeat the same query — for example, polling a search — change
the arguments or pass a fresh idempotency_key per call.
Turn structured results into final answers
A successful paid tool result and a useful user-facing answer are separate steps. Preserve the raw result, prepare bounded model context, run a text-only synthesis call, and keep a deterministic fallback for an empty, generic, filtered, or truncated answer.prepared.modelContext contains bounded, model-safe evidence; prepared.raw is the untouched result for private storage and audit. Do not put the raw value into the synthesis prompt. Search results keep titles, URLs, and short snippets; artifacts keep a descriptor and safe summary rather than binary bytes or oversized JSON.
Use answer.usedFallback to record when the deterministic answer won. A length finish reason, empty or generic text, content filtering, unexpected tool calls, or an error should use the fallback instead of hiding another paid retry. Store the raw result, normalized context, final answer, artifact, per-step charges, combined charge, call IDs, idempotency keys, and inference diagnostics separately.
See Inference for finish-reason, visible-output, reasoning-token, and billed-token diagnostics.
Rotate or revoke a connection
lastUsedAt, rotate before expiry, and revoke idle or unexpected connections.
Troubleshoot a connection
Start with the HTTP status and machine-readablecode. Locus rejects connection and policy failures before contacting a provider or burning credits.
Verify the endpoint directly
Use an MCPinitialize request to separate transport and authentication problems from the agent framework:
200 JSON-RPC response confirms the URL, transport, and credential. Next send tools/list with the same headers to inspect the connection-filtered catalog.
Never paste a full credential into a support ticket or log. Share the connection ID, display prefix, status, environment, HTTP status, and error code instead.
Next steps
Framework integrations
OpenAI, Anthropic, Vercel, Google, LangChain, CrewAI, LlamaIndex, Mastra, AutoGen, and raw MCP recipes.
SDK reference
Manage connections and make direct calls with
@withlocus/credits.