Standalone product OAuth2, JWT & WebAuthn

sgcAuth: OAuth2, JWT & WebAuthn Components for Delphi & C++ Builder

Two client components carry the token side of modern authentication into your application. TsgcHTTP_OAuth2_Client runs the Authorization Code, PKCE, Client Credentials, Resource Owner Password and Device Code grants against any OAuth2/OIDC provider. TsgcHTTP_JWT_Client builds, signs and verifies JSON Web Tokens, on its own or as the Bearer token source for your WebSocket and HTTP clients. sgcAuth is standalone, it bundles the sgcWebSockets Core runtime both clients are built on.

Download Free Trial See the Components

Full source code

Delphi 7 to 13 & C++ Builder

Bundled runtime sgcWebSockets Core The HTTP, TLS and JSON runtime under both clients

OAuth2 TsgcHTTP_OAuth2_Client

JWT TsgcHTTP_JWT_Client

2 Client components One page on the component palette

9 RFCs implemented OAuth2, PKCE, DPoP, Device Code, JWT/JWS/JWE and more

5 Platforms Windows, macOS, Linux, iOS and Android

100% Source code included Both clients and the bundled Core runtime

12 Months of updates Every release published while your license is active

BEFORE YOU BUY

Three Things Worth Knowing First

What sgcAuth needs from you, whether you already own these components, and what WebAuthn needs on top. All three answers are short.

sgcAuth is self-contained

Standalone, the sgcWebSockets Core runtime is included: the HTTP/TLS client stack both components POST their token requests through, and the JSON machinery that parses the responses. One SKU, one installer.

Full source code ships with every license, so both clients and the runtime under them step through in your own debugger rather than disappearing into a binary.

Edition overlap

Already in your sgcWebSockets edition?

Both the OAuth2 Client and the JWT Client ship inside sgcWebSockets from the Standard edition up, so if you own any sgcWebSockets edition you already have both components. All-Access includes everything.

sgcAuth exists for the opposite case: you want OAuth2 and JWT client support in Delphi or C++ Builder without licensing a full sgcWebSockets edition. Check what your edition already covers before you buy.

Add-on required

WebAuthn needs sgcCustomIndy

Passwordless sign-in with WebAuthn is served by TsgcWSAPIServer_WebAuthn, a sgcWebSockets Enterprise/All-Access component built on the patched Indy library that sgcCustomIndy ships as an add-on. WebAuthn requires the sgcCustomIndy add-on, which is added automatically when you order sgcAuth.

Already own a sgcCustomIndy license? Remove the automatically added line from your cart before checkout, no extra charge either way.

WHAT IS IN THE BOX

Two Clients, the Whole Token Lifecycle

Each one is a non-visual component you drop on a form or create in code, declared under the sgc unit prefix and registered on the SGC Auth palette page. Set the provider details, wire the events, then call Start.

OAuth21 component

Five grant types, one component

TsgcHTTP_OAuth2_Client drives OAuth2Options.GrantType through auth2Code for trusted server-side apps, auth2CodePKCE for native, mobile and single-page apps, auth2ClientCredentials for daemons and service accounts, auth2ResourceOwnerPassword, and auth2DeviceCode (RFC 8628) for smart TVs, kiosks and other input-constrained devices. Point AuthorizationServerOptions at the provider's authorize, token, revocation and introspection endpoints and the component handles the rest: when Active/Start runs the Authorization Code flow, it opens the system browser and stands up a small local HTTP server from LocalServerOptions to catch the redirect, exchanging the code for a token over plain HTTPS through HTTPClientOptions. Refresh, Revoke and Introspect cover the token lifecycle after that, and DPoPOptions plus GenerateDPoPKeyPair add DPoP proof-of-possession (RFC 9449) for providers that require it. Ready-made Google and Microsoft presets configure the common endpoints and scopes for you.

TsgcHTTP_OAuth2_Client RFC 6749 · PKCE · Device Code · DPoP

JWT1 component

Sign, attach or verify, your choice

TsgcHTTP_JWT_Client publishes everything RFC 7519 needs through JWTOptions: the JOSE Header (alg, typ, kid), the registered Payload claims (iss, sub, aud, exp, nbf, iat, jti, plus custom claims through AddKeyValue), and the key material under Algorithms for HMAC (HS.Secret), RSA (RS.PrivateKey) and ECDSA (ES.PrivateKey). Call Sign to get the compact-serialization token back directly, useful for services with no built-in HTTP or WebSocket client, or set RefreshTokenAfter and let the component refresh iat/exp and re-sign automatically. The same component plugs straight into Authentication.Token.JWT on TsgcWebSocketClient, TsgcHTTP1Client and TsgcHTTP2Client, so every outbound request carries a fresh Bearer token without you touching the header yourself.

TsgcHTTP_JWT_Client RFC 7519 · JWS · JWE

USE CASES

Authentication Flows from Delphi Code

Both components are ordinary non-visual components, so they slot into whatever your application already is: a VCL desktop app, a Windows service, a Linux daemon. These are the patterns customers build, each mapped to the property or method that drives it.

Ready-made Google and Microsoft presets configure the authorize and token endpoints and scopes for you.

Server-to-server API access auth2ClientCredentials

Background jobs and service accounts authenticate to an API without a user in the loop.

Smart TVs, kiosks & IoT devices auth2DeviceCode

The device shows a short code, the user finishes sign-in on their phone or laptop.

Long sessions without re-prompting Refresh

Exchange a refresh token for a new access token behind the scenes, no browser hand-off needed.

Authenticate your own WebSocket & HTTP APIs Authentication.Token.JWT

The JWT Client signs Bearer tokens for TsgcWebSocketClient, TsgcHTTP1Client and TsgcHTTP2Client automatically.

Stand-alone token signing Sign

Build and sign a JWT string for any codebase, no WebSocket or HTTP component required.

HOW IT WORKS

A Browser Hand-Off, a Signature, and a Bundled Runtime

OAuth2 and JWT solve different problems, one negotiates a token with a remote server, the other signs one locally, and that is the point of packaging them together: sgcAuth hides the difference behind the same component conventions, with the bundled sgcWebSockets Core runtime doing the plumbing underneath.

OAuth2 is a browser hand-off, then plain HTTPS

Start opens the system browser (or, for Device Code, hands you the user code to display) and a local HTTP listener from LocalServerOptions catches the authorization redirect. The exchange for the access token is a plain HTTPS POST issued through HTTPClientOptions, on the Core runtime's HTTP client stack.

JWT is signing, not networking

TsgcHTTP_JWT_Client never opens a socket. JWTOptions configures the header, payload and key material, and Sign returns the compact-serialization token, HMAC, RSA or ECDSA, ready to attach to any request your own code sends.

The Core runtime is in the box

Standalone, the sgcWebSockets Core runtime is included. It contributes the HTTP/TLS client stack both components POST through and the JSON parser that reads the responses, and its full source is part of the package like everything else.

WebAuthn is the third piece, via sgcCustomIndy

Passwordless sign-in is handled by TsgcWSAPIServer_WebAuthn, a sgcWebSockets Enterprise/All-Access server component that needs the patched Indy build sgcCustomIndy ships. Ordering sgcAuth adds sgcCustomIndy to your cart automatically.

QUICK START

Get a Token, Sign a Token

Both components follow the same shape: configure the options, then call a method. They compile in Delphi 7 to 13 and C++ Builder, and the same properties are exposed on .NET.

uses
  sgcHTTP_OAuth2_Client, sgcHTTP_JWT_Client;

var
  OAuth2: TsgcHTTP_OAuth2_Client;
  JWT: TsgcHTTP_JWT_Client;
begin
  // OAuth2: Authorization Code Grant with PKCE
  OAuth2 := TsgcHTTP_OAuth2_Client.Create(nil);
  OAuth2.OAuth2Options.GrantType := auth2CodePKCE;
  OAuth2.OAuth2Options.ClientId := 'your-client-id';
  OAuth2.AuthorizationServerOptions.AuthURL := 'https://provider.com/oauth2/authorize';
  OAuth2.AuthorizationServerOptions.TokenURL := 'https://provider.com/oauth2/token';
  OAuth2.AuthorizationServerOptions.Scope.Text := 'openid profile';
  OAuth2.LocalServerOptions.IP := '127.0.0.1';
  OAuth2.LocalServerOptions.Port := 8080;
  OAuth2.OnAfterAccessToken := OAuth2AccessToken;
  OAuth2.Start;   // opens the browser; the redirect lands on the local server

  // JWT: sign a token for your own API
  JWT := TsgcHTTP_JWT_Client.Create(nil);
  JWT.JWTOptions.Header.alg := jwtHS256;
  JWT.JWTOptions.Algorithms.HS.Secret := '79F66F1E-E998-436B-8A0A-3E5DEFA4FD9E';
  JWT.JWTOptions.Payload.iss := 'your-service';
  JWT.JWTOptions.Payload.sub := '1234567890';
  JWT.JWTOptions.Payload.iat := DateTimeToUnix(Now);
  ShowMessage(JWT.Sign);
end;

procedure TForm1.OAuth2AccessToken(Sender: TObject);
begin
  Memo1.Lines.Add('Access token received.');
end;

The same JWT component attaches to a WebSocket or HTTP client directly: set Client.Authentication.Token.Enabled := True and Client.Authentication.Token.JWT := JWT, and every request goes out with a fresh Bearer token.

// include: sgcHTTP_OAuth2_Client.hpp, sgcHTTP_JWT_Client.hpp

// OAuth2: Authorization Code Grant with PKCE
TsgcHTTP_OAuth2_Client *OAuth2 = new TsgcHTTP_OAuth2_Client(this);
OAuth2->OAuth2Options->GrantType = auth2CodePKCE;
OAuth2->OAuth2Options->ClientId = "your-client-id";
OAuth2->AuthorizationServerOptions->AuthURL = "https://provider.com/oauth2/authorize";
OAuth2->AuthorizationServerOptions->TokenURL = "https://provider.com/oauth2/token";
OAuth2->AuthorizationServerOptions->Scope->Text = "openid profile";
OAuth2->LocalServerOptions->IP = "127.0.0.1";
OAuth2->LocalServerOptions->Port = 8080;
OAuth2->OnAfterAccessToken = OAuth2AccessToken;
OAuth2->Start();   // opens the browser; the redirect lands on the local server

// JWT: sign a token for your own API
TsgcHTTP_JWT_Client *JWT = new TsgcHTTP_JWT_Client(this);
JWT->JWTOptions->Header->alg = jwtHS256;
JWT->JWTOptions->Algorithms->HS->Secret = "79F66F1E-E998-436B-8A0A-3E5DEFA4FD9E";
JWT->JWTOptions->Payload->iss = "your-service";
JWT->JWTOptions->Payload->sub = "1234567890";
JWT->JWTOptions->Payload->iat = DateTimeToUnix(Now());
ShowMessage(JWT->Sign());

void __fastcall TForm1::OAuth2AccessToken(TObject *Sender)
{
  Memo1->Lines->Add("Access token received.");
}

The same JWT component attaches to a WebSocket or HTTP client directly: set Client->Authentication->Token->Enabled = true and Client->Authentication->Token->JWT = JWT, and every request goes out with a fresh Bearer token.

PLATFORMS

Pure HTTPS and Signing, No Native Library

Neither component depends on anything beyond the Core runtime's HTTP client stack and the platform's crypto primitives, so both compile and run wherever Delphi does.

TsgcHTTP_OAuth2_Client Authorization Code, PKCE, Client Credentials, Resource Owner Password, Device Code

Windows Win32 Windows Win64 Linux64 macOS iOS Android

TsgcHTTP_JWT_Client HS256/384/512, RS256/384/512, ES256/384/512

Windows Win32 Windows Win64 Linux64 macOS iOS Android

IDE support One source tree, design-time packages per version

Delphi 7 to 13 C++ Builder

Trial installer The sgcWebSockets All-Access trial includes the Auth components

One download, both components

Download the trial installer →

PRICING

A Standalone Package

sgcAuth is licensed on its own, starting at €149 for a single developer. All licenses include full source code, 1 year of updates and a 50% to 70% renewal discount: 50% when you renew one pack, 60% for two, 70% for three or more. sgcAI, sgcMQ, sgcSocial, sgcCustomIndy, sgcAuth and sgcHTTP each count as a pack.

sgcAuth

€149

Single, Team and Site licenses available.

OAuth2 client: Authorization Code, PKCE, Client Credentials, Device Code
JWT client to issue, sign & verify tokens
WebAuthn passkeys, via sgcCustomIndy (added automatically)
sgcWebSockets Core runtime included
Delphi 7 to 13 & C++ Builder
Full source code
1 year of updates

sgcAuth includes the sgcWebSockets Core runtime, so there is nothing else to buy for the OAuth2 and JWT clients.

Buy Single License €149

Team €249 Site €399

Checkout lists two items: the sgcWebSockets Core runtime entitlement, which is charged at zero, and the sgcAuth pack itself. sgcCustomIndy is added automatically for WebAuthn, remove it if you already own a license. Full pricing details.

3,000+Developers

20+Years

761+Components

30+API Integrations

5Platforms

30-Day Money-Back GuaranteeNot satisfied? Request a full refund within 30 days of purchase. See refund policy

Other Products by eSeGeCe

Pair sgcAuth with our other Delphi, C++ Builder and .NET component libraries.

sgcWebSockets

The full library: WebSocket clients and servers, HTTP/2, IoT, P2P and AI components. Its editions include the OAuth2 and JWT clients too.

Learn more →

sgcCustomIndy

The custom Indy library sgcWebSockets Enterprise is built on, packaged as an add-on. Required for WebAuthn, added automatically to sgcAuth orders.

Learn more →

sgcAI

AI, LLM and MCP components. One chat component reaches OpenAI, Anthropic, Gemini, DeepSeek, Ollama, Grok and Mistral.

Learn more →

sgcMQ

Native MQTT 3.1.1/5.0, AMQP 0.9.1, AMQP 1.0, Apache Kafka and STOMP client components, with the Core runtime bundled.

Learn more →

sgcSocial

WhatsApp Business Cloud API and Telegram TDLib client components, with the Core runtime bundled.

Learn more →

sgcHTML

Data-aware server-side HTML/UI components for Delphi, C++ Builder and .NET, with Bootstrap 5 and htmx, including a WebAuthn login UI component.

Learn more →

sgcAuth: OAuth2, JWT & WebAuthn Components for Delphi & C++ Builder

Three Things Worth Knowing First

sgcAuth is self-contained

Already in your sgcWebSockets edition?

WebAuthn needs sgcCustomIndy

Two Clients, the Whole Token Lifecycle

Five grant types, one component

Sign, attach or verify, your choice

Authentication Flows from Delphi Code

A Browser Hand-Off, a Signature, and a Bundled Runtime

Get a Token, Sign a Token

Pure HTTPS and Signing, No Native Library

A Standalone Package

sgcAuth

Ship Authentication, Not a Token Library

Other Products by eSeGeCe

sgcWebSockets

sgcCustomIndy

sgcAI

sgcMQ

sgcSocial

sgcHTML