---
title: "Read Locus CLI credential status"
method: GET
path: "/credits/cli/credential"
tags: ["Authentication"]
---

# Read Locus CLI credential status

`GET /credits/cli/credential`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/cli/credential`
- Auth: OAuth 2
  - Authorization code: `https://api.paywithlocus.com/api/credits/mcp/oauth/authorize`
  - Token URL: `https://api.paywithlocus.com/api/credits/mcp/oauth/token` scopes: `mcp:read`, `mcp:execute`

Reads the lcac_ credential bound to the caller's Locus OAuth connection. It never returns the raw credential. Send a Locus MCP OAuth access token with mcp:read and mcp:execute, issued to the Locus CLI client.

## Response `200`

Current credential state for this OAuth connection

- object
  - `success` unknown, required
  - `identityProvider` 'locus-oauth', required
  - `installationId` string, required
  - `account` OkibiLinkedAccount, required: The Locus user behind the Okibi identity link. Locus provisions an account for an Okibi-verified email that has none; that account keeps a managed password until the person sets one through the emailed link or the dashboard's first screen.
    - `email` string, email, required
    - `passwordSetupPending` boolean, required: True while the provisioned account still has to choose a password. Tell the user to check their email for the Locus set-password link.
  - `credentialConfigured` boolean, required
  - `connection` OkibiCliConnectionMetadata, required
    - `id` string, uuid, required
    - `status` 'active' | 'expired' | 'revoked', required
    - `keyPrefix` string, required: Non-secret display prefix.
    - `tools` OkibiCliConnectionTools, required
      - `enable` string[], nullable, required: Provider/endpoint slugs this credential may call. null means every endpoint the workspace has enabled.
    - `expiresAt` string, date-time, required: Moves forward on each authenticated use, to 7 days after that use and never past 30 days after issue.
    - `lastUsedAt` string, date-time, nullable, required
  - `bootstrap` object, required
    - `method` 'POST', required
    - `registrationToken` string, required
    - `tools` string, required

## Other responses

- `401`: Missing, invalid, or expired Locus OAuth access token
- `403`: Missing mcp:execute, or the signed-in account can no longer act for the workspace

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)