---
title: "Complete AgentID authorization-code verification"
method: GET
path: "/credits/agent/identity/agentid/callback"
tags: ["Agent-native onboarding"]
---

# Complete AgentID authorization-code verification

`GET /credits/agent/identity/agentid/callback`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/agent/identity/agentid/callback`
- Auth: none required

Exchanges an AgentID authorization code with PKCE, verifies ES256 issuer, audience, nonce, stable subject, and live inbox, and marks the pending signup identity-verified. The callback never returns a Locus credential; the agent replays POST /credits/agent/register to receive it. This is the only AgentID callback: an MCP authorization started at /credits/mcp/oauth/authorize/agentid returns here with its lmo_req_ state and is redirected to the MCP client's registered callback with an authorization code or OAuth error.

## Query parameters

- `code` string, required
- `state` string, required
- `iss` 'https://auth.agentid.com', required

## Response `200`

Static success page; replay registration to activate

## Other responses

- `400`: Invalid, denied, expired, or unverifiable AgentID callback
- `503`: AgentID or signup configuration is temporarily unavailable

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)