Latest Content

How to Revoke All User Authorizations for Your OAuth Application

Updated on 21 July, 2026

Revoke every user's tokens for an OAuth application you own using the Vultr Console or the Vultr API, forcing all users to re-authorize the application.

Revoking all user authorizations for an OAuth application you own invalidates every outstanding token that every user granted the application. This is an application-owner action that affects all users who authorized the application at once, not a single user's own access. Use it when you need to force every user to re-authorize, for example after rotating credentials or responding to a suspected compromise.

Follow this guide to revoke all user authorizations for your OAuth application using the Vultr Console and the Vultr API.

Note
This action revokes every user's tokens for the application. Each user must authorize the application again before it can act on their account. To revoke only your own authorization for an application, see How to Revoke Access for an Authorized OAuth Application.
  • Vultr Console
  • Vultr API

  1. Log in to the Vultr Console.

  2. Click the organization name in the top navigation bar, then click Manage Organization.

  3. Click OAuth Applications.

  4. Click the application to open its management page.

  5. Click Revoke all user tokens.

    All outstanding tokens for the application stop working immediately.

  1. Send a GET request to the List OAuth Clients endpoint to find the application id.

    console 
    $ curl "https://api.vultr.com/v2/oauth/clients" \
    -X GET \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

    The response lists your applications under oauth_clients. Note the id of the application whose authorizations you want to revoke.

  2. Send a DELETE request to the Revoke All OAuth Client Authorizations endpoint to revoke every user's authorization. Replace {client-id} with your application id.

    console 
    $ curl "https://api.vultr.com/v2/oauth/clients/{client-id}/authorizations" \
    -X DELETE \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

    A successful request returns an HTTP 204 No Content response with no response body. Every user's tokens for the application stop working immediately, and each user must authorize the application again before it can act on their account.

Comments