---
title: How to Obtain an Identity Token from Instance or Bare Metal Metadata
url: https://docs.vultr.com/platform/iam/product-integrations/instance-and-bare-metal-auth/obtain-identity-token
description: Request a signed JWT identity token from the metadata service on a Vultr instance or Bare Metal server.
publish_date: 2026-09-21T20:22:29.235444Z
last_updated: 2026-10-23T20:36:16.056399Z
---

A Vultr Cloud Compute instance or Bare Metal server can request a signed identity token from its local metadata service. The token is a JWT that identifies the specific server, your Vultr account, and the server's resource type, and it is used to assume an IAM role without a stored API key or user credentials. The metadata service is only reachable from inside the server itself, at the fixed link-local address `169.254.169.254`.

Follow this guide to request an identity token from within a running instance or bare metal server.

1. Connect to the instance or bare metal server as a user with shell access.

1. Request the identity token from the metadata service.

    ```console
    $ curl http://169.254.169.254/v1/identity/token
    ```

    The response is the raw JWT string, not wrapped in JSON. Decoding its payload shows claims similar to the following, differing by server type:

    ```
    {
      "iss": "https://api.vultr.com/v2/oidc/identity/instance",
      "sub": "instance:1bb24763-3220-4f18-84b8-5b9d0eba7ce2",
      "aud": "vultr-iam",
      "acctid": 8238469,
      "orgid": 5768803,
      "resource_type": "instance",
      "region": "ord",
      "exp": 1789066313,
      "iat": 1789066013
    }
    ```

    On a Bare Metal server, `iss` ends in `/baremetal`, `sub` is prefixed `baremetal:`, and `resource_type` is `baremetal`. The token expires 5 minutes after issuance (`exp` minus `iat`), so request a fresh token immediately before using it rather than caching it.