Latest Content

How to Manage the Draft-Mode User Allowlist for an OAuth Application

Updated on 21 July, 2026

Add and remove the Vultr users allowed to authorize a Draft OAuth application so you can test the authorization flow before approval, using the Vultr API.

While an OAuth application is in Draft, PendingReview, or Rejected status, only the Vultr users on its allowlist can authorize it. This lets you test the full authorization flow with teammates or QA accounts before the application is approved for general use. The root user who creates the application is added to the allowlist automatically.

Follow this guide to add and remove users on the draft-mode allowlist using the Vultr API. The Vultr Console does not provide a way to manage the allowlist, so use the API.

Note
Managing the allowlist requires the organization's root user. A non-root user receives an HTTP 403 Forbidden response. The allowlist applies only to non-active applications. Once an application reaches Active status, any Vultr user can authorize it and these endpoints return an HTTP 409 Conflict response.

  1. Send a GET request to the List OAuth Clients endpoint to retrieve your applications and find the target application's id.

    console 
    $ curl "https://api.vultr.com/v2/oauth/clients" \
    -X GET \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

    The response lists your applications under oauth_clients. Note the id of the target application to use as the client ID in the following steps.

  2. Send a POST request to the Add Draft User endpoint to add a user by email. Replace {client-id} with your application id and USER-EMAIL with the user's Vultr account email.

    console 
    $ curl "https://api.vultr.com/v2/oauth/clients/{client-id}/draft_users" \
    -X POST \
    -H "Authorization: Bearer ${VULTR_API_KEY}" \
    -H "Content-Type: application/json" \
    -d '{
        "email": "USER-EMAIL"
    }'

    A successful request returns an HTTP 201 Created response with the updated application object, including the new entry in draft_users. An email that does not belong to a registered Vultr user returns an HTTP 404 Not Found response.

  3. Send a GET request to the Read OAuth Client endpoint to retrieve the current allowlist. Replace {client-id} with your application id.

    console 
    $ curl "https://api.vultr.com/v2/oauth/clients/{client-id}" \
    -X GET \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

    The response contains a draft_users array. Note the user_id of any user you want to remove.

  4. To remove a user, send a DELETE request to the Remove Draft User endpoint. Replace {client-id} with your application id and {user-id} with the user's account id from the previous step.

    console 
    $ curl "https://api.vultr.com/v2/oauth/clients/{client-id}/draft_users/{user-id}" \
    -X DELETE \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

    A successful deletion returns an HTTP 204 No Content response with no response body. Removing a user does not revoke any authorization they already granted.

Comments