---
title: "Approve or deny an MCP device authorization"
method: POST
path: "/credits/mcp/oauth/device/decision"
tags: ["MCP"]
---

# Approve or deny an MCP device authorization

`POST /credits/mcp/oauth/device/decision`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/mcp/oauth/device/decision`
- Auth: HTTP bearer

Resolves one pending device request for the explicitly selected active membership. Approval reserves connection-plan capacity until the client exchanges the device code or the 15-minute request expires. A same-client retry by the same person supersedes its unfinished reservation.

## Headers

- `X-Locus-Tenant-Id` string, uuid

## Request body

- object
  - `userCode` string, required: Case-insensitive device-code input. Locus ignores non-alphanumeric punctuation, rejects ambiguous characters, and normalizes the six significant characters to XXX-XXX.
  - `allow` boolean, required

## Response `200`

Request approved or denied

- McpOAuthDeviceDecisionResponse
  - `success` unknown, required
  - `data` object, required
    - `status` 'approved' | 'denied', required

## Other responses

- `400`: Invalid/expired user code, invalid account selection, or missing signed-in user
- `401`: Dashboard session required
- `403`: Selected membership is unavailable
- `409`: The request was already resolved or the account has no connection capacity
- `429`: Too many verification attempts

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)