Skip to main content
Connect an agent to its approved metered APIs through interactive OAuth or a scoped enterprise service credential. Never paste a tenant secret key into an MCP client.

Choose authorization

Personal accounts manage OAuth clients under Connections. Included supports one active OAuth-connected client, Plus supports three, and Unlimited removes the cap. Capacity includes active grants and approved browser or device authorizations that have not exchanged their code yet. Retrying with the same client replaces its unfinished authorization. Browser reservations last 20 minutes; device reservations last 15 minutes. Enterprise users configure interactive clients under Integrate; trusted servers can issue endpoint- and budget-scoped service credentials.

Enterprise service credentials

What an agent connection is

An agent connection is not another kind of API key. It is a saved setup for one agent: which credit account it spends from, which endpoints it may call, which end-user pricing overrides apply, how much it may spend per call and per run, and when its access ends. Creating one returns a matching lcac_… credential, and that credential can only ever act inside the setup it was issued for. The name follows from what you get back. You are not handed only a token to go configure a client with — you are handed the finished connection, MCP URL and header included:
The credential is one field of the connection, not the whole of it. Rotating swaps the credential and leaves the setup in place; revoking ends both.

Agent connection or tenant secret key?

Both can authenticate a metered call, which is the usual source of confusion. They are not interchangeable, and only one of them belongs in an agent. Both are bounded by the tenant catalog, and either credential can narrow endpoints. An Agent Connection additionally fixes the spending account and can set per-call and per-run ceilings. Creating, rotating, or revoking keys; managing members; and other owner-and-step-up operations require the workspace owner’s dashboard session, not a tenant key. The secret key appears exactly once in this flow: you use it to create the connection. After that the agent holds only the lcac_… credential and the secret key stays on your server.
Never put a lcr_… tenant secret key in an agent, MCP client, prompt, browser, or customer environment. The MCP endpoint does accept one, so pasting it in appears to work — and that client then spends without the per-call or per-run ceilings a connection would impose. A broad key may also carry non-owner management scopes, while an execution-policy key can narrow endpoints but still lacks connection budgets. In most clients the key sits in a plaintext config file.

Install the Locus plugin

The Locus plugin configures the hosted MCP server and installs the Locus skills in one step on Claude Code, Codex, and Grok. OpenClaw installs the same plugin and adds the server with one MCP command; Cursor connects through the MCP client tabs further down this page until its marketplace listing is live.
Run /mcp, select locus, and choose Authenticate.
The plugin registers the server under the alias locus and authenticates with interactive OAuth. If you previously added the same server manually as locus-pro using OAuth, remove that entry so the client keeps a single connection. Keep any manual entry that carries an enterprise service credential: the plugin never replaces credential-based configuration, so on that path use the manual setup in enterprise service-credential configuration instead of the plugin’s connection, or the client will expose duplicate tools.

Give your coding agent the Locus skills

The plugin above already bundles the same locus and locus-setup skills this command installs — run this step only for an agent where you skipped the plugin, and use one source per agent so they are not installed twice:
The skills teach an agent how to choose a Locus product, create a least-privilege connection, make metered calls safely, and handle long-running paid work. They do not install or store credentials.

Choose a connection method

All methods reach the same catalog, pricing engine, ledger, endpoint policy, and reservation and refund path. MCP adds tool discovery and schemas. The SDK and REST path give your application direct control over each call. The official CLI installer is https://okibi.ai/i/locus/locus. The signed release includes its command reference and an agent skill, so install the CLI as one artifact instead of copying generated instructions separately. The repo-backed release targets the production Locus Pro API by default; use an explicit profile only when intentionally connecting to an isolated stage or local environment.

Set up an enterprise service credential

1

Enable the tenant catalog

Enable the provider endpoints your application is allowed to offer. A connection can narrow this catalog, but it cannot re-enable a tenant-disabled endpoint.
2

Create a scoped connection

Choose the pooled platform account or one immutable end-user account. Pin the required provider/endpoint slugs, optionally set end-user pricing overrides, and set an expiry plus per-call and per-loop limits.
3

Store the credential immediately

Locus returns the full lcac_… credential only on create and rotate. Store it in your runtime’s secret manager or environment, never in source control.
4

Connect and observe

Add the MCP configuration or use the credential with the SDK or REST path. Monitor status, expiry, and last use from the dashboard or API.

Create a connection

Credit limits are exact decimal strings in your tenant’s credit denomination. Tool slugs, account binding, and connection-specific pricing are immutable. To change one, create a replacement connection and revoke the old one once the replacement is in use.

Connection scope and budgets

mode: "platform" draws from the tenant’s pooled balance at the base Locus price. mode: "end_user" requires one externalUserId and draws from only that end-user balance at the tenant’s effective price. Do not reuse one end-user connection across customers. For an end-user connection, pricing can override the tenant pricing inherited by that credential. Endpoint values outrank the connection default, which outranks the tenant default; the workspace markup ceiling still applies:
The dashboard exposes these fields under API Keys → Service credentials → Spend and pricing controls. The @withlocus/credits 0.5.2 typed create helper does not accept pricing; use the REST request or dashboard when you need a connection-level price policy.
Omitting tools inherits every endpoint currently enabled for the tenant. Sending tools: { enable: [] } grants no provider endpoints. Built-in MCP discovery and balance tools remain available, but execution is denied.
When maxCreditsPerLoop is set, reuse one loop ID for all paid calls in the same autonomous run:
Direct HTTP callers send X-Locus-Agent-Loop-Id. MCP callers pass loop_id to execute, or a nested _locus: { "loop_id": "…" } object to a dedicated endpoint tool. Concurrent reservations cannot race past the connection limit. Unused capacity is returned after capture or refund.

Connect an MCP client

Locus Pro exposes a hosted, stateless MCP server over Streamable HTTP:
Official plugin configurations may send X-Source-Name for aggregate client telemetry. It never changes authentication, identity, or billing. Use interactive OAuth for personal accounts and for a person-authorized enterprise client. In a personal account, open Connections and choose the client. In an enterprise workspace, open Integrate → MCP clients. Add the public MCP URL without an authorization header, then complete Locus sign-in and consent in the browser.

Agent-owned headless OAuth

An activated agent-owned account uses the same MCP Authorization Code + PKCE flow without requiring a GUI browser. Keep the MCP login process and any loopback callback listener alive so the client retains its PKCE verifier. Follow the printed authorization URL, capture the opaque request=lmo_req_… value from the Locus consent URL, and request its safe signed-out context:
The response exposes no tenant or identity data. Follow data.agentIdAuthorizationUrl, preserving the HTTP cookie that produced the AgentID request ID. Approve that exact 22-character ID with the inbox’s P-256 key, then fetch AgentID’s /v0/authorize/continue using the same cookie and follow every redirect. The canonical agent/auth.md reference defines the exact JWS and HTTP contract. Do not remove or rewrite the final code, state, or iss parameters. The redirect returns to the callback URI registered by the MCP client. If a remote loopback callback is unreachable, use that client’s documented manual-code mode or SSH port forwarding. AgentID approval itself does not require a GUI; human involvement remains appropriate only for an AgentMail inbox OTP or the Stripe funding handoff.

Headless device authorization (RFC 8628)

A client that cannot receive an OAuth redirect can use the device-code grant. Register a device client once with dynamic client registration — the device grant must be requested in grant_types, refresh_token alongside it keeps the session renewable, and a device-only client omits redirect_uris entirely:
Then start the flow with that client ID:
Show the returned verification_uri_complete or verification_uri and user_code to the user. While they approve, poll POST /api/credits/mcp/oauth/token with the returned device_code, client_id, MCP resource, and grant_type=urn:ietf:params:oauth:grant-type:device_code. Wait at least the returned interval. Keep waiting on authorization_pending; add five seconds after slow_down; stop on a terminal error. The code expires after 15 minutes and can issue tokens once. A user who belongs to multiple workspaces must send X-Locus-Tenant-Id on the signed-in consent context and decision calls, or those return 409; the public-context fetch needs no tenant selection.

Enterprise service-credential configuration

For a truly unattended enterprise runtime, authenticate with the one-time lcac_… value from the Agent Connection response. The tabs below deliberately configure a bearer value and do not open an OAuth prompt.
Put the credential in your environment:
Add the server to ~/.codex/config.toml:
Codex CLI, the Codex app, and the IDE extension share this configuration.
For hosted model APIs and framework-native MCP configuration, use Framework integrations. Those clients differ in whether they expect the raw token or a complete bearer header.

OAuth behavior and token lifecycle

An interactive MCP client follows the server’s OAuth discovery flow without a pre-provisioned lcac_… credential. Codex uses codex mcp login; Claude Code starts the flow from /mcp; Cursor, VS Code, Gemini CLI, and ChatGPT expose it from their MCP connection UI. The person signs in to Locus Pro, chooses an account when necessary, and grants the requested scopes. The normal grant is mcp:read mcp:execute offline_access. Read-only workspace members receive discovery-only access, and a deliberately read-only application can request mcp:read offline_access. Access tokens last 15 minutes; refresh tokens last up to 30 days and rotate on use. Revocation, removed membership, suspended workspaces, expired grants, and refresh-token reuse all fail closed. OAuth is the default for a person-authorized desktop or application connection and for an agent-owned account using AgentID. An agent-owned account can complete its OAuth handoff browserlessly as described above. Enterprise workloads that need a fixed account, endpoint allowlist, expiry, and spend ceilings should use an Agent Connection. A tenant secret key remains a server-side fallback and never belongs in a desktop configuration. Applications that own the redirect can use LocusMcpOAuth from @withlocus/credits for protected-resource and authorization-server discovery, PKCE, dynamic registration, callback validation, refresh rotation, and revocation. openAiMcpTool() builds the OpenAI MCP tool shape and defaults per-tool approval to never; opt into requireApproval only when your application deliberately wants another prompt. Redirect URIs must be exact HTTPS URLs, loopback HTTP URLs for native clients, or RFC 8252 reverse-domain private-use URLs. Native loopback callbacks may vary only the listening port. Gemini CLI requires a local browser and callback listener, so use a service credential in a browserless container or SSH session.

Use the MCP tools

Every authenticated MCP session gets a compact built-in toolset plus the enabled endpoints allowed by its account and credential scope: The server exposes only these meta-tools by default, whatever the catalog size; every visible endpoint is searchable and callable by slug through execute. Execution-scoped sessions may additionally expose the enabled capability tools (router_web_search, web_research, travel_flights) automatically, and dedicated {provider}_{endpoint} tools appear for slugs you pin in the MCP URL query (?tool= / ?tools=), up to 20. For OAuth, the visible catalog comes from the approved account and its enabled tools. For an Agent Connection, it is the intersection of the enterprise catalog and the connection’s immutable tool allowlist. Locus applies the effective scope to discovery, schemas, estimates, and execution. A stale or forged call returns an error before provider dispatch. If search_apis returns no results, use its reason:
1

Discover

Call search_apis or list_apis, then describe_api for the exact input schema.
2

Estimate and approve

Call estimate_cost when the action is dynamic, expensive, or sensitive. Send expires_in_seconds when needed, then preserve the returned approval_token and idempotency_key for execution.
3

Execute

Call execute (required when consuming an approval_token) or a dedicated endpoint tool for unapproved calls. Reuse one idempotency key across retries and one loop ID across the autonomous run.
4

Read the result

Check isError, then use the provider data, credits charged, and remaining balance. Non-streaming failures release their reservation automatically; MCP rejects streaming requests, so accepted-stream settlement applies only to REST inference calls.
estimate_cost has one public approval contract. It accepts expires_in_seconds from 30 through 600 (default 120) and returns approval_id, approval_token, approval_mode, quoted_credits, max_charge_credits, idempotency_key, and expires_at. Pass the unchanged approval_token, arguments, and idempotency key to execute — only execute accepts an approval token; dedicated endpoint tools cannot consume one. If automatic chat inference and ask-before-use external tools share one agent turn, use a bounded server policy for automatic inference and keep external tool approval in your trusted application. The locus-pro agent skill contains the complete two-connection reference flow. Native ask mode intentionally requires approval for every paid execution, including chat inference.

Cancel an unused approval

When an approved call will not run — the plan changed or the quote will expire unused — release it with cancel_cost_approval:
Both cancel_cost_approval and execute take the approval_token; approval_id is a reference for your logs and dashboard lookups, and no tool accepts it as an argument.

Idempotency and replay

When you omit idempotency_key, the server derives one from the authenticated principal’s tenant and bound user, the provider/endpoint, and the canonicalized arguments, on a 60-second time bucket. The previous bucket is also accepted, so the effective replay window is 60–120 seconds. Keys are isolated to the paying account. Agent Connection keys are additionally scoped to that connection, OAuth keys to the stable member/client pair, and end-user accounts are already separate. Tenant secret keys intentionally share account-wide idempotency so retries can survive key rotation. A semantically identical call inside that window replays the original result and receipt without a new charge. Replayed responses are marked with locus/idempotentReplay: true in the result _meta and idempotent_replay: true in the structured output, so you can tell a cache hit from a fresh call. Supplying your own idempotency_key makes the call replayable indefinitely under that key; the time window applies only to server-derived keys. To intentionally repeat the same query — for example, polling a search — change the arguments or pass a fresh idempotency_key per call.

Turn structured results into final answers

A successful paid tool result and a useful user-facing answer are separate steps. Preserve the raw result, prepare bounded model context, run a text-only synthesis call, and keep a deterministic fallback for an empty, generic, filtered, or truncated answer.
prepared.modelContext contains bounded, model-safe evidence; prepared.raw is the untouched result for private storage and audit. Do not put the raw value into the synthesis prompt. Search results keep titles, URLs, and short snippets; artifacts keep a descriptor and safe summary rather than binary bytes or oversized JSON. Use answer.usedFallback to record when the deterministic answer won. A length finish reason, empty or generic text, content filtering, unexpected tool calls, or an error should use the fallback instead of hiding another paid retry. Store the raw result, normalized context, final answer, artifact, per-step charges, combined charge, call IDs, idempotency keys, and inference diagnostics separately. See Inference for finish-reason, visible-output, reasoning-token, and billed-token diagnostics.

Rotate or revoke a connection

Rotation preserves the connection ID and scope but replaces the credential immediately. Revocation is idempotent and permanent. Monitor lastUsedAt, rotate before expiry, and revoke idle or unexpected connections.

Troubleshoot a connection

Start with the HTTP status and machine-readable code. Locus rejects connection and policy failures before contacting a provider or burning credits.

Verify the endpoint directly

Use an MCP initialize request to separate transport and authentication problems from the agent framework:
A 200 JSON-RPC response confirms the URL, transport, and credential. Next send tools/list with the same headers to inspect the connection-filtered catalog. Never paste a full credential into a support ticket or log. Share the connection ID, display prefix, status, environment, HTTP status, and error code instead.

Next steps

Framework integrations

OpenAI, Anthropic, Vercel, Google, LangChain, CrewAI, LlamaIndex, Mastra, AutoGen, and raw MCP recipes.

SDK reference

Manage connections and make direct calls with @withlocus/credits.