---
title: "Read Okibi CLI credential bootstrap status"
method: GET
path: "/credits/okibi/cli-credential"
tags: ["Okibi Identity"]
---

# Read Okibi CLI credential bootstrap status

`GET /credits/okibi/cli-credential`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/okibi/cli-credential`
- Auth: HTTP bearer

A real Okibi-protected resource used to verify the signed CLI release, active identity grant, durable Locus account binding, and current installation credential state. It never returns the raw native credential. The account block names the linked Locus user and whether that user still has to choose a password. Requires both mcp:read and mcp:execute from Okibi Identity.

## Response `200`

Verified installation and current native credential state

- object
  - `success` unknown, required
  - `identityProvider` 'okibi', required
  - `installationId` string, required
  - `account` OkibiLinkedAccount, required: The Locus user behind the Okibi identity link. Locus provisions an account for an Okibi-verified email that has none; that account keeps a managed password until the person sets one through the emailed link or the dashboard's first screen.
    - `email` string, email, required
    - `passwordSetupPending` boolean, required: True while the provisioned account still has to choose a password. Tell the user to check their email for the Locus set-password link.
  - `credentialConfigured` boolean, required
  - `connection` OkibiCliConnectionMetadata, required
    - `id` string, uuid, required
    - `status` 'active' | 'expired' | 'revoked', required
    - `keyPrefix` string, required: Non-secret display prefix.
    - `tools` OkibiCliConnectionTools, required
      - `enable` string[], nullable, required: Provider/endpoint slugs this credential may call. null means every endpoint the workspace has enabled.
    - `expiresAt` string, date-time, required: Moves forward on each authenticated use, to 7 days after that use and never past 30 days after issue.
    - `lastUsedAt` string, date-time, nullable, required
  - `bootstrap` object, required
    - `method` 'POST', required
    - `registrationToken` string, required
    - `tools` string, required

## Other responses

- `401`: Missing, invalid, expired, or inactive Okibi capability
- `403`: Missing mcp:read/mcp:execute or inactive Locus membership

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)