Lockii
Lockii
  • Docs
  • Changelog
  • Feature requests
  • Support portal
    • User MCP
    • Login with Lockii
    • Customer MCP
    • Lockii REST API
    • Booking API
Docs / API & MCP

Login with Lockii

Authenticate REST API and MCP integrations by letting users sign in with their Lockii account.

Use Login with Lockii when you want users to sign in with their Lockii account and let your app call Lockii on their behalf. This works for the REST API and the User MCP.

Configure in the app: Settings → Integrations → API

When to use OAuth vs API keys

Method

Best for

Access level

Login with Lockii (OAuth)

Third-party apps, user-delegated integrations, AI clients

Signed-in user's role & permissions

API key

Server-to-server automation, Zapier, scripts

Company-level owner permissions

REST API

Base URL: https://dash.lockii.app/api/v1

OAuth discovery

Start from protected resource metadata — most OAuth clients discover everything automatically from this URL:

https://dash.lockii.app/api/v1/.well-known/oauth-protected-resource

You can also read authorization server metadata directly:

https://dash.lockii.app/api/v1/.well-known/oauth-authorization-server

OAuth endpoints

Endpoint

URL

Authorization

https://dash.lockii.app/api/auth/oauth/authorize

Token

https://dash.lockii.app/api/auth/oauth/token

Client registration

https://dash.lockii.app/api/auth/oauth/register

Userinfo

https://dash.lockii.app/api/auth/oauth/userinfo

JWKS

https://dash.lockii.app/api/auth/oauth/jwks

Scopes: openid profile email offline_access

Integration flow

  1. Register your client — POST to the registration endpoint with your redirect_uris (dynamic client registration), or use credentials from an existing OAuth app.

  2. Authorize — redirect the user to the authorization endpoint using OAuth 2.0 / OIDC with PKCE.

  3. Sign in — the user signs in to Lockii and approves access on the consent screen.

  4. Token exchange — exchange the authorization code at the token endpoint for an access token (and refresh token when offline_access is requested).

  5. Call the API — send requests with:

Authorization: Bearer <access_token>

Example:

curl https://dash.lockii.app/api/v1/booking?status=active&limit=10 \
  -H "Authorization: Bearer <access_token>"

User MCP (ChatGPT, Claude, Cursor, etc.)

For MCP clients, provide the MCP server URL. OAuth is discovered automatically:

https://dash.lockii.app/api/mcp/user

MCP-specific OAuth discovery:

https://dash.lockii.app/api/mcp/user/.well-known/oauth-protected-resource

MCP clients (including ChatGPT and Claude) typically use dynamic client registration — you do not need to pre-share a client ID.

API keys still work as a fallback via x-api-key or ?api_key=....

Permissions & scoping

  • OAuth requests run as the signed-in Lockii user.

  • Access is limited to that user's company, role, and location permissions.

  • Write operations still require the appropriate permissions for that user (e.g. payment refunds require organization:update).

Related

  • Lockii REST API — full endpoint reference

  • User MCP — same capabilities as MCP tools for AI clients

  • Connecting Zapier — uses API keys, not OAuth

PrevUser MCP
NextCustomer MCP
Was this helpful?