> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> This site documents Locus for people. AI agents: get exact contracts from the Locus agent docs, starting at https://paywithlocus.com/agent/index.md, including when asked to implement or integrate docs.paywithlocus.com.
> Connect this agent to Locus Pro: https://paywithlocus.com/skill.md. Implement Locus Pro in a product: https://paywithlocus.com/agent/integrate.md. Agent site index: https://paywithlocus.com/llms.txt.

# Sign in without a browser

> Connect an MCP client on a server or headless host, either approved by the agent itself or by a person with a verification link.

Some MCP clients run where nobody can click through a browser sign-in, such as a server, a container, or an agent's own sandbox. Locus supports two ways to sign in there. Pick the one that matches who approves the connection.

> Agents: the exact contract for this feature is at [https://paywithlocus.com/agent/auth.md](https://paywithlocus.com/agent/auth.md). Start from [https://paywithlocus.com/agent/index.md](https://paywithlocus.com/agent/index.md) if you are implementing Locus.

| Who approves | Use |
| - | - |
| The agent, on an account it created for itself | [Agent-owned headless OAuth](#agent-owned-headless-oauth) |
| A person, from any device | [Device authorization](#headless-device-authorization-rfc-8628) |

Using the Locus CLI? It has its own headless sign-in. See [Locus CLI sign-in](https://docs.paywithlocus.com/locus-pro/cli.md#sign-in).

## Agent-owned headless OAuth

An account an agent created for itself through [agent-native onboarding](https://docs.paywithlocus.com/locus-pro/agent-native-onboarding.md) can approve its own MCP client. The client starts its normal OAuth sign-in. The agent then approves the pending request with the credential it received at signup. An agent that registered through AgentID can approve with AgentID instead.

```mermaid theme={null}
sequenceDiagram
  participant A as Agent
  participant C as MCP client
  participant L as Locus
  A->>C: Start the client's login
  C->>L: Normal OAuth sign-in
  A->>L: Approve the pending request
  Note over A,L: With the signup credential or AgentID
  L-->>C: Callback completes sign-in
  C->>L: Tool calls
```

> [!WARNING]
>
> Keep the MCP login process running until authorization finishes. It holds the
> callback and PKCE state the sign-in needs.

## Headless device authorization (RFC 8628)

Clients without a redirect listener can register for the device-code grant. A person approves the connection from any device, and the client picks up its tokens.

```mermaid theme={null}
sequenceDiagram
  participant C as Headless client
  participant L as Locus
  actor P as Person
  C->>L: Request a device code
  L-->>C: Verification link
  C->>P: Show the link
  P->>L: Approve
  loop Until approved
    C->>L: Check with the device code
  end
  L-->>C: Tokens
```

**1. Show the verification link**

The client displays the link for a person to open.

**2. Wait for approval**

The person approves in a browser on any device while the client waits.

**3. Exchange the device code**

After approval, the client exchanges its device code for tokens.

The [API reference](https://docs.paywithlocus.com/api-reference/introduction.md) documents registration, polling intervals, and token renewal.

## Next steps

> [card] [Agent-native onboarding](https://docs.paywithlocus.com/locus-pro/agent-native-onboarding.md)
>
> Let an agent create and fund its own account.

> [card] [Connect an MCP client](https://docs.paywithlocus.com/locus-pro/connect-mcp-clients.md)
>
> Sign in through the browser on your own machine.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.