Latest Content

How to Call the Vultr API with an OAuth Access Token

Updated on 21 July, 2026

Call the Vultr API on a customer's behalf by presenting an OAuth access token as a Bearer token, scoped to the permissions the customer consented to you.

An OAuth access token is an RS256 JSON Web Token (JWT) that your application presents as a Bearer token to the Vultr API. The token acts on behalf of the customer who authorized your application and is limited to the scopes they consented to, so it can never exceed the permissions the user held at consent time. An access token is valid for 1 hour (3600 seconds), after which the application uses its refresh token to obtain a new one.

Follow this guide to call the Vultr API with an OAuth access token using the Vultr API.

Note
A delegated OAuth token is confined to its granted scope. It cannot manage API keys and cannot access endpoints that require account-level authority. Calls outside the granted scope return an HTTP 403 Forbidden response.

Send a request to any Vultr API endpoint that accepts user authentication, passing the access token as a Bearer token. This example calls the Get Account Info endpoint. Replace ACCESS-TOKEN with the JWT from the token exchange.

console 
$ curl "https://api.vultr.com/v2/account" \
    -X GET \
    -H "Authorization: Bearer ACCESS-TOKEN"

The response contains the data the endpoint returns, scoped to the permissions the user consented to. A token whose grant does not cover the endpoint returns an HTTP 403 Forbidden response, and an expired token returns an HTTP 401 Unauthorized response. When a token expires, use your refresh token to obtain a new one rather than sending the user through consent again.

Comments