Latest Content

How to Attach a Scope to an OAuth Application

Updated on 21 July, 2026

Attach an IAM permission policy as a scope to a Vultr OAuth application to define the access it requests, using the Vultr Console or the Vultr REST API.

A scope defines the permissions your OAuth application requests from the customers who authorize it. Each scope is an IAM permission policy from your own organization. When you attach a policy, Vultr saves a permanent copy that backs the scope. The copied policy is always read-only, and the original policy is also read-only while it is attached as a scope.

Follow this guide to attach a scope to an OAuth application using the Vultr Console and the Vultr API. An application must have at least one scope before you can submit it for review.

Note
Attaching a scope requires the organization's root user. A non-root user receives an HTTP 403 Forbidden response. An OAuth application supports one scope at a time. Detach the existing scope before attaching a different one. Create an IAM policy first if you do not already have one. You can change the scope only while the application is in Draft or Rejected status. A PendingReview or Active application is locked.
  • Vultr Console
  • Vultr API

  1. Log in to the Vultr Console.

  2. Click the organization name in the top navigation bar.

  3. Click Manage Organization.

  4. Click OAuth Applications.

  5. Click the Edit icon next to the application, open its management page, or click Create OAuth App to set the scope during creation.

  6. Under Permission Policy, use the search field to find a policy and select it.

  7. Click Save as Draft to keep the application editable, or Send for Review to submit it for review.

    The selected policy is saved as a read-only copy that backs the application's permission scope. The copy is always read-only, and the original policy is read-only while it is attached.

  1. Send a POST request to the Attach OAuth Scope endpoint to attach an IAM policy as a scope. Replace {client-id} with your application id and SOURCE-POLICY-ID with the IAM policy id.

    console 
    $ curl "https://api.vultr.com/v2/oauth/clients/{client-id}/scopes" \
    -X POST \
    -H "Authorization: Bearer ${VULTR_API_KEY}" \
    -H "Content-Type: application/json" \
    -d '{
        "policy_id": "SOURCE-POLICY-ID"
    }'

    A successful request returns an HTTP 200 OK response with the updated application object. Attaching the same policy again is a no-op, while attaching a different policy while one is already attached returns an HTTP 409 Conflict response.

  2. Send a GET request to the List OAuth Scopes endpoint to retrieve the attached scope. Replace {client-id} with your application id.

    console 
    $ curl "https://api.vultr.com/v2/oauth/clients/{client-id}/scopes" \
    -X GET \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

    The response contains an attachments array. Verify that the policy.id matches the source policy you attached.

  3. To remove a scope, send a DELETE request to the Detach OAuth Scope endpoint. Replace {client-id} with your application id and {source-policy-id} with the source policy id you attached.

    console 
    $ curl "https://api.vultr.com/v2/oauth/clients/{client-id}/scopes/{source-policy-id}" \
    -X DELETE \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

    A successful deletion returns an HTTP 204 No Content response with no response body. The source policy remains unchanged.

Comments