PApaywithlocus
Okibi Identity

Bootstrap a scoped Locus CLI credential from Okibi Identity

Exchanges a verified Okibi identity grant for one Locus lcac_ execution credential bound to the Okibi identity, CLI installation, and selected workspace. The credential expires 7 days after its last use and never later than 30 days after issue; every bootstrap issues it fresh for 7 days. Generate registrationToken locally from exactly 24 random bytes encoded as unpadded base64url. Replaying the token renews the installation's credential unchanged; a new token rotates that credential in place (same connection, new secret and prefix). A revoked credential is never renewed or rotated. When tools is present the server enables exactly those catalog slugs and restricts the credential to them; when it is omitted the credential may use every endpoint the workspace has enabled, and a fresh bootstrap may replace or lift an existing allowlist. The token is never stored; Locus stores only the derived credential hash.

post/credits/okibi/cli-credential

Request

  • Base URL
    https://api.paywithlocus.com/api
  • URL
    https://api.paywithlocus.com/api/credits/okibi/cli-credential
  • Auth
    HTTP bearer

Request body

registrationTokenstring required

Canonical base64url encoding of 24 bytes generated by a cryptographically secure random-number generator.

Response

Existing credential renewed (same token) or rotated in place (new token); rotated tells which

successunknown required
createdboolean required

True when this bootstrap created the installation's credential (HTTP 201).

rotatedboolean required

True when a new registration token replaced the existing credential's secret in place (HTTP 200).

Changes

No recorded changes to this operation across all 1 revision of this API.