---
title: "Start MCP device authorization"
method: POST
path: "/credits/mcp/oauth/device_authorization"
tags: ["MCP"]
---

# Start MCP device authorization

`POST /credits/mcp/oauth/device_authorization`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/mcp/oauth/device_authorization`
- Auth: none required

RFC 8628 authorization for a headless public client registered with the device-code grant. Send the exact MCP resource. Locus returns a 15-minute device code, a human-readable user code, and a five-second initial polling interval. Do not send client authentication.

## Request body `application/x-www-form-urlencoded`

- McpOAuthDeviceAuthorizationRequest
  - `client_id` string, required
  - `resource` string, uri, required: Exact Locus Pro MCP resource URL.
  - `scope` string

## Response `200`

Pending device authorization

- McpOAuthDeviceAuthorizationResponse
  - `device_code` string, required: Secret device grant credential. Keep it only in the client that initiated the device flow and do not log it.
  - `user_code` string, required: Human-readable code that omits ambiguous characters. Display it exactly as returned.
  - `verification_uri` string, uri, required
  - `verification_uri_complete` string, uri, required
  - `expires_in` 900, required
  - `interval` 5, required: Initial minimum token-poll interval in seconds. A slow_down response increases it by five seconds, up to 60 seconds.

## Other responses

- `400`: Invalid client, resource, scope, or grant registration
- `401`: Unknown client or an Authorization header was supplied
- `415`: Content type must be application/x-www-form-urlencoded

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)