Latest Content

OAuth Identity Provider

Updated on 21 July, 2026

Register OAuth applications, authorize third-party access, and issue scoped RS256 access tokens through the Vultr OAuth identity provider and its REST API.

Vultr acts as an OAuth 2.0 identity provider, letting a customer register a third-party application that other Vultr customers can authorize. Once a customer authorizes an application, it receives a signed JSON Web Token (JWT) that it presents to the Vultr API as a Bearer token, scoped to the permissions the customer consented to and never beyond that customer's own access.

This overview describes the actors, resources, and lifecycle of the Vultr OAuth Identity Provider. Use it to understand how the individual guides in this section fit together.

Actors

The OAuth flow involves three actors, and the guides are organized around them.

  • Application developer: A Vultr customer who registers and manages an OAuth application. These tasks require an API key that belongs to the root user of the organization.
  • End user: A Vultr customer who authorizes a third-party application to act on their account and manages or revokes that access.
  • Application runtime: The third-party application code that exchanges authorization codes for access tokens and calls the Vultr API on the end user's behalf.

Resources

The OAuth system is built on a small set of resources.

  • OIDC provider: A Vultr-hosted RSA keypair that signs the tokens an application presents to the Vultr API. Each provider has its own issuer identity and discovery document.
  • OAuth application: The registered client, identified by a client id and secret, linked to an OIDC provider and a set of callback URLs.
  • Scope: An IAM permission policy attached to the application that defines what the application can request.
  • Authorization: The record of an end user's consent, which backs the tokens the application holds.
  • Access token: The short-lived JWT the application presents to the Vultr API, paired with a refresh token for renewal.

Application Lifecycle

An OAuth application moves through a defined set of states.

  • Draft: The application is editable. Only users on its allowlist can authorize it. You attach a scope, set callback URLs, and test the flow in this state.
  • PendingReview: The application is submitted and locked against edits while an administrator reviews it.
  • Active: The application is approved and available to any Vultr customer. It remains locked against edits.
  • Rejected: The application was not approved. Editing any field returns it to Draft.

Token Model

After an end user authorizes an application, the application exchanges a one-time authorization code for an access token at the provider's token endpoint. The authorization code expires in 10 minutes and is single-use, while the access token is a one-hour RS256 JWT. The application renews the token with a rotating refresh token rather than sending the user through consent again. Revoking an authorization tears down the grant and invalidates every token the application holds.

OAuth Applications
Register, configure, and manage OAuth applications on Vultr, including their scopes, logos, draft-mode allowlist, and their complete application lifecycle.

Management

Register, list, update, submit, regenerate the secret for, and delete OAuth applications across their complete lifecycle on Vultr using the Vultr API.

How to Attach a Scope to an OAuth Application

Attach an IAM permission policy as a scope to a Vultr OAuth application to define the access it requests, using the Vultr Console or the Vultr REST API.

How to Add a Logo to an OAuth Application

Add a logo to a Vultr OAuth application so it appears on the customer consent screen, uploaded as a base64 image using the Vultr Console or the Vultr API.

How to Manage the Draft-Mode User Allowlist for an OAuth Application

Add and remove the Vultr users allowed to authorize a Draft OAuth application so you can test the authorization flow before approval, using the Vultr API.

How to List Users Who Authorized Your OAuth Application

List every Vultr user who authorized your OAuth application, including revoked grants, so you can audit delegated access to the app using the Vultr API.

How to Revoke All User Authorizations for Your OAuth Application

Revoke every user's tokens for an OAuth application you own using the Vultr Console or the Vultr API, forcing all users to re-authorize the application.

Authorizations
Authorize third-party OAuth applications, view the applications you granted access to, and revoke that access on Vultr using the Vultr REST API endpoints.

How to Authorize a Third-Party OAuth Application

Grant a third-party OAuth application access to your Vultr account within your own permissions and receive a one-time authorization code using the API.

How to View Your Authorized OAuth Applications

View every third-party OAuth application you authorized on Vultr, along with the scopes each application was granted, to manage delegated access via the API.

How to Revoke Access for an Authorized OAuth Application

Revoke a third-party OAuth application's access to your Vultr account, invalidating its access and refresh tokens immediately, using the Vultr REST API.

Access Tokens
Exchange authorization codes for access tokens, call the Vultr API with a token, apply PKCE, and integrate a third-party app end to end with Vultr OAuth.

How to Call the Vultr API with an OAuth Access Token

Call the Vultr API on a customer's behalf by presenting an OAuth access token as a Bearer token, scoped to the permissions the customer consented to you.

How to Use PKCE with Vultr OAuth

Protect the Vultr OAuth authorization code flow with Proof Key for Code Exchange by generating a verifier and challenge for public client applications.

How to Integrate a Third-Party App with Vultr OAuth

Integrate a third-party application with Vultr OAuth end to end, from creating a provider through exchanging a code and calling the Vultr API with a token.