Skip to main content
Some MCP clients run where nobody can click through a browser sign-in, such as a server, a container, or an agent’s own sandbox. Locus supports two ways to sign in there. Pick the one that matches who approves the connection. Using the Locus CLI? It has its own headless sign-in. See Locus CLI sign-in.

​
Agent-owned headless OAuth

An account an agent created for itself through agent-native onboarding can approve its own MCP client. The client starts its normal OAuth sign-in. The agent then approves the pending request with the credential it received at signup. An agent that registered through AgentID can approve with AgentID instead.
Keep the MCP login process running until authorization finishes. It holds the callback and PKCE state the sign-in needs.

​
Headless device authorization (RFC 8628)

Clients without a redirect listener can register for the device-code grant. A person approves the connection from any device, and the client picks up its tokens.
1

Show the verification link

The client displays the link for a person to open.
2

Wait for approval

The person approves in a browser on any device while the client waits.
3

Exchange the device code

After approval, the client exchanges its device code for tokens.
The API reference documents registration, polling intervals, and token renewal.

​
Next steps

Agent-native onboarding

Let an agent create and fund its own account.

Connect an MCP client

Sign in through the browser on your own machine.