---
title: "Create a scoped Agent Connection"
method: POST
path: "/credits/agent-connections"
tags: ["Authentication", "MCP"]
---

# Create a scoped Agent Connection

`POST /credits/agent-connections`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/agent-connections`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Creates a short-lived, least-privilege lcac_ credential for MCP and wrapped execution. Because the returned credential can spend credits, callers must hold both credentials:manage and credits:move rather than delegating spend authority they do not hold. A secret key with both scopes may automate this route; human callers must be a workspace owner or admin with fresh MFA/passkey step-up.

## Headers

- `X-Locus-Step-Up` string, password

## Request body

- AgentConnectionCreateRequest
  - `name` string, required
  - `mode` 'platform' | 'end_user', required
  - `externalUserId` string: Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.
  - `tools` object
    - `enable` string[]
  - `pricing` CredentialPricingPolicy
    - `markupBps` integer
    - `flatMarkupUsdc` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
    - `endpoints` object
  - `maxCreditsPerCall` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
  - `maxCreditsPerLoop` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
  - `expiresInSeconds` integer

## Response `201`

Connection created; credential is returned once

- AgentConnectionEnvelope
  - `success` unknown, required
  - `connection` AgentConnection, required
    - `id` string, uuid, required
    - `name` string, required
    - `status` 'active' | 'expired' | 'revoked', required
    - `mode` 'platform' | 'end_user', required
    - `externalUserId` string: Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.
    - `tools` object
      - `enable` string[], nullable
    - `pricing` CredentialPricingPolicy
      - `markupBps` integer
      - `flatMarkupUsdc` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `endpoints` object
    - `maxCreditsPerCall` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
    - `maxCreditsPerLoop` string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
    - `keyPrefix` string, required
    - `expiresAt` string, date-time, required
    - `revokedAt` string, date-time, nullable
    - `rotatedAt` string, date-time, nullable
    - `lastUsedAt` string, date-time, nullable
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `mcp` object, required
      - `url` string, uri, required
      - `headers` object
    - `credential` string: Present only in create/rotate responses and shown once

## Other responses

- `400`: Invalid identity, endpoint, expiry, or exact-credit scope
- `401`: Missing, invalid, expired, or revoked management credential
- `403`: The authenticated management credential lacks one or more required scopes

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)