Two components carry the token side of modern authentication into your application. TsgcHTTP_OAuth2_Client runs the Authorization Code, PKCE, Client Credentials, Resource Owner Password and Device Code grants against any OAuth2/OIDC provider. TsgcHTTP_JWT_Client builds, signs and verifies JSON Web Tokens, on its own or as the Bearer token source for your WebSocket and HTTP clients. Standalone, the sgcWebSockets Core runtime is included.
JWT, OAuth2 and WebAuthn, on the client side and the server side, from Delphi. Narrated and captioned. Nothing downloads until you press play.
Tokens, delegated authorisation and passkeys in one package.
exp and nbf are checked, and a request with a bad token never reaches your handler.Drop a component on a form, set the provider or key details, wire the events, then call Start or Sign. The naming is consistent across both, so an authentication flow reads the same whichever grant or algorithm it uses.
TsgcHTTP_OAuth2_Client drives OAuth2Options.GrantType through auth2Code for trusted server-side apps, auth2CodePKCE for native, mobile and single-page apps, auth2ClientCredentials for daemons and service accounts, auth2ResourceOwnerPassword, and auth2DeviceCode (RFC 8628) for smart TVs, kiosks and other input-constrained devices.
Start opens the system browser and stands up a small local HTTP server from LocalServerOptions to catch the redirect, exchanging the code for a token over plain HTTPS. Refresh, Revoke and Introspect cover the token lifecycle after that, and DPoPOptions adds proof-of-possession (RFC 9449) for providers that require it.
TsgcHTTP_JWT_Client publishes everything RFC 7519 needs through JWTOptions: the JOSE Header, the registered Payload claims (iss, sub, aud, exp, nbf, iat, jti, plus custom claims), and the key material for HMAC, RSA and ECDSA. Call Sign for the compact-serialization token directly, or set RefreshTokenAfter and let the component re-sign automatically.
The JWT component plugs straight into Authentication.Token.JWT on TsgcWebSocketClient, TsgcHTTP1Client and TsgcHTTP2Client, so every outbound request carries a fresh Bearer token without a line of header code.
Passwordless sign-in is served by TsgcWSAPIServer_WebAuthn, a sgcWebSockets Enterprise/All-Access component built on the patched Indy library that sgcCustomIndy ships as an add-on. It is always included when you order sgcAuth, and so are the TOTP, LDAP, SAML, OpenID Connect and Mail OAuth2 components.
Sign in with Google or Microsoft, server-to-server API access, smart TVs and kiosks, long sessions without re-prompting, and Bearer tokens for your own WebSocket and HTTP APIs. Both components run happily inside a VCL or FMX application, a service or a console process.
The feature matrix →Neither component depends on anything beyond the Core runtime's HTTP client stack and the platform's crypto primitives, so both compile and run wherever Delphi does: Windows, macOS, Linux 64-bit, iOS and Android. From Delphi 7 through RAD Studio 13 and on C++ Builder.
The feature matrix →sgcAuth speaks the published OAuth2/OIDC and JWT/JWS standards rather than wrapping a vendor SDK, so the provider is your choice: Google, Microsoft, Auth0, Okta, Keycloak, or any RFC-compliant authorization server. Ready-made Google and Microsoft presets configure the common endpoints and scopes for you.
Provider setup →sgcAuth is a standalone package. It bundles the sgcWebSockets Core runtime it is built on, and every license ships with full source code, so the token exchanges step through in your own debugger. Deployment is royalty-free.
See pricing →Reference pages for each component:
Configure the options, then call a method. Both components compile in Delphi 7 to 13 and C++ Builder, and the same properties are exposed on .NET.
uses
sgcHTTP_OAuth2_Client;
var
OAuth2: TsgcHTTP_OAuth2_Client;
begin
OAuth2 := TsgcHTTP_OAuth2_Client.Create(nil);
OAuth2.OAuth2Options.GrantType := auth2CodePKCE;
OAuth2.OAuth2Options.ClientId := 'your-client-id';
OAuth2.AuthorizationServerOptions.AuthURL := 'https://provider.com/oauth2/authorize';
OAuth2.AuthorizationServerOptions.TokenURL := 'https://provider.com/oauth2/token';
OAuth2.AuthorizationServerOptions.Scope.Text := 'openid profile';
OAuth2.LocalServerOptions.IP := '127.0.0.1';
OAuth2.LocalServerOptions.Port := 8080;
OAuth2.OnAfterAccessToken := OAuth2AccessToken;
OAuth2.Start; // opens the browser; the redirect lands on the local server
end;
procedure TForm1.OAuth2AccessToken(Sender: TObject);
begin
Memo1.Lines.Add('Access token received.');
end;uses
sgcHTTP_JWT_Client;
var
JWT: TsgcHTTP_JWT_Client;
begin
JWT := TsgcHTTP_JWT_Client.Create(nil);
JWT.JWTOptions.Header.alg := jwtHS256;
JWT.JWTOptions.Algorithms.HS.Secret := '79F66F1E-E998-436B-8A0A-3E5DEFA4FD9E';
JWT.JWTOptions.Payload.iss := 'your-service';
JWT.JWTOptions.Payload.sub := '1234567890';
JWT.JWTOptions.Payload.iat := DateTimeToUnix(Now);
ShowMessage(JWT.Sign);
// or attach it to a WebSocket / HTTP client directly:
// Client.Authentication.Token.Enabled := True;
// Client.Authentication.Token.JWT := JWT;
end;The same shape in Object Pascal and in C++ Builder. The full feature matrix →
TsgcHTTP_OAuth2_Client and TsgcHTTP_JWT_Client sit on one palette page.OnAfterAccessToken hands you the token, and the refresh, revoke and introspect calls follow the same pattern.Frames from the sgcAuth quickstart video.
The JWT client signs with HMAC, RSA or ECDSA and rides along as an Authorization: Bearer header. On the other side the signature is checked against the same secret or public key, expired and not-yet-valid tokens are rejected, and a request with a bad token never reaches your handler.
Authorization Code for web apps with a back end, PKCE for native and mobile apps, Client Credentials for machine to machine, Device Code for TVs and consoles. Refresh, revocation, introspection and DPoP are handled for you as well.
The server sends a random challenge, the authenticator signs it with the private key, and the server checks it against the stored public key. A user signs in with a passkey, a fingerprint or a hardware key, and the private key never leaves the device.
What sgcAuth needs from you, whether you already own these components, what WebAuthn needs on top, and which IDEs it targets. The answers are short, and they are on this page rather than in the small print.
job component grants / algorithms
OAuth2 TsgcHTTP_OAuth2_Client Code, PKCE, Client Credentials,
Resource Owner Password, Device Code
JWT TsgcHTTP_JWT_Client HS256/384/512, RS256/384/512, ES256/384/512
already own it?
Both the OAuth2 Client and the JWT Client ship inside
sgcWebSockets from the Standard edition up.
sgcAuth is for licensing OAuth2 + JWT without a full
sgcWebSockets edition.TsgcWSAPIServer_WebAuthn is built on the patched Indy library that sgcCustomIndy ships as an add-on. It is always included when you order sgcAuth, and the sgcAuth price shown already covers it.Grants, refresh, revocation and signing are all first-class methods and events, and full source code means nothing in between is a black box. Every component and property →
sgcAuth is one package of the sgcWebSockets family. Buy it standalone with the Core runtime bundled in, or get both clients with any sgcWebSockets edition from Standard up.
The OAuth2 and JWT clients, standalone, with the sgcWebSockets Core runtime included.
The same package, licensed for a whole team or a whole site.
The full library: WebSocket clients and servers, HTTP/2, IoT, P2P and AI components. Its editions include the OAuth2 and JWT clients too.
If you own any sgcWebSockets edition you already have both clients. sgcAuth is for OAuth2 and JWT without licensing a full sgcWebSockets edition.
View pricing and licensesTrusted by Delphi, C++ Builder, Lazarus and .NET developers around the world.
Your sgcWebSockets library is very useful and easy to setup. Keep up the good work!
sgcWebSockets is amazing and your support is the best!
Thanks so much for your help and support, I love your components.
OAuth2 and JWT in one package, with the sgcWebSockets Core runtime bundled in and full source code in the box.
sgcAuth is one of the eSeGeCe component libraries for Delphi, C++ Builder and .NET. They share conventions, they ship with full source, and they deploy royalty-free.
WebSocket, HTTP/2, MQTT, AMQP, WebRTC, AI and 30+ API integrations for Delphi, C++ Builder, Lazarus and .NET. This is where the Core runtime lives.
HTTP server, HTTP/2 client, gRPC client and Google Cloud Pub/Sub, Calendar and FCM clients for Delphi and C++ Builder. Standalone, with the sgcWebSockets Core runtime bundled in.
REST server, OpenAPI server and OpenAPI client components for Delphi and C++ Builder. Standalone, with the sgcWebSockets Core runtime bundled in.
MQTT, AMQP 0.9.1 and 1.0, Apache Kafka and STOMP client components for Delphi and C++ Builder. Standalone, with the sgcWebSockets Core runtime bundled in.
AI, LLM and MCP components for Delphi and C++ Builder. Seven LLM providers behind one component, plus MCP, embeddings and speech. Standalone, with the sgcWebSockets Core runtime bundled in.
Telegram and WhatsApp Business client components for Delphi and C++ Builder. Standalone, with the sgcWebSockets Core runtime bundled in.
Server-side HTML and UI components on Bootstrap 5 and htmx, including a WebAuthn login UI component.
Raw QUIC transport and an HTTP/3 client and server, with WebTransport. An add-on to sgcWebSockets Enterprise.
OpenAPI 3.x parser, native Pascal SDK generator, OpenAPI server component, and 1,195+ pre-built cloud SDKs.
XAdES, PAdES, CAdES and ASiC for documents, Authenticode, ClickOnce, NuGet and VSIX for code.
Create, edit, view, sign, redact and validate PDF files in pure Object Pascal, with no DLL to deploy. Licensed on its own.
Windows Hello, fingerprint sensors and the Windows Biometric Framework for Delphi and C++ Builder.
Packs, add-ons and more
