Everything sgcAuth does, mapped across the two client components, the grant types and claims they implement, and the WebAuthn capability the pack unlocks together with sgcCustomIndy. Every capability works the same in Delphi and C++ Builder, and every license ships full source code.
Five grant types, one component
Sign, attach or verify
Passkeys, via sgcCustomIndy
Delphi 7 to 13, C++ Builder
sgcAuth is self-contained. It ships with the sgcWebSockets Core runtime bundled in, so it is not an add-on for the OAuth2 and JWT clients.
Also inside sgcWebSockets. Both the OAuth2 Client and the JWT Client also ship inside sgcWebSockets editions from Standard up. All-Access includes everything. sgcAuth is the standalone package for teams that only need the authentication clients.
Two sides of the same problem, registered on the SGC Auth palette page.
| Component | Class | Job | Description |
|---|---|---|---|
| OAuth2 Client | TsgcHTTP_OAuth2_Client | Get a token | Authorization Code, PKCE, Client Credentials, Resource Owner Password and Device Code grants against any OAuth2/OIDC provider, with a built-in local redirect server. |
| JWT Client | TsgcHTTP_JWT_Client | Sign a token | Builds, signs and verifies JSON Web Tokens, standalone or as the Bearer token source for TsgcWebSocketClient, TsgcHTTP1Client and TsgcHTTP2Client. |
TsgcHTTP_OAuth2_Client covers OAuth 2.0 (RFC 6749) end to end: it starts the flow, catches the redirect, exchanges the code for a token, and manages the token afterward.
| Capability | API | Notes |
|---|---|---|
| Authorization Code | OAuth2Options.GrantType := auth2Code | The standard flow for trusted server-side web applications that can hold a client secret. |
| Authorization Code + PKCE | auth2CodePKCE (RFC 7636) | The same flow with a Proof Key for Code Exchange, for native, mobile and single-page apps that cannot keep a secret. |
| Client Credentials | auth2ClientCredentials | Server-to-server calls with no user in the loop: daemons and service accounts. |
| Resource Owner Password | auth2ResourceOwnerPassword | The application collects the user's password directly and exchanges it for a token. |
| Device Code | auth2DeviceCode (RFC 8628) | For input-constrained devices, smart TVs, media consoles, IoT: shows a user code the person enters on a second device. |
| Client identity | OAuth2Options.ClientId, ClientSecret, Username, Password | Set per your provider's API specification; Username/Password cover providers that require Basic Authentication on the token endpoint. |
| Provider endpoints | AuthorizationServerOptions.AuthURL, TokenURL, Scope, RevocationURL, IntrospectionURL | The URLs and scope list published in your provider's OAuth2/OIDC documentation. |
| Social presets | TsgcHTTP_OAuth2_Client_Google, TsgcHTTP_OAuth2_Client_Microsoft | Ready-made descendants that pre-configure the Google and Microsoft endpoints and scopes. |
| Local redirect listener | LocalServerOptions.IP, Port, RedirectURL | The small HTTP server the component starts to receive the authorization-code redirect; defaults to port 8080, or 0 to pick a random port for desktop apps. |
| Run the flow | Start, Stop | Start opens the system browser (or issues the device code) and begins the configured grant; Stop aborts it and shuts the local listener. |
| Refresh | Refresh | Exchanges a refresh token for a new access token without another browser round trip. |
| Revoke & introspect | Revoke (RFC 7009), Introspect (RFC 7662) | Invalidate a token, or query its status and metadata at the provider. |
| DPoP | DPoPOptions, GenerateDPoPKeyPair, OnDPoPSign | Demonstrating Proof-of-Possession (RFC 9449) key material and signing, for providers that bind tokens to a key pair. |
| HTTP transport | HTTPClientOptions | TLS and logging configuration for the internal HTTP client that POSTs to the token, revocation and introspection endpoints. |
| Lifecycle events | OnBeforeAuthorizeCode, OnAfterAuthorizeCode, OnBeforeAccessToken, OnAfterAccessToken, OnBeforeRefreshToken, OnAfterRefreshToken | Before/after pairs around each step of the flow. |
| Error events | OnErrorAccessToken, OnErrorAuthorizeCode, OnErrorRefreshToken, OnErrorRevokeToken, OnErrorIntrospectToken | One per failure point in the flow, each carrying the provider's error, description and URI. |
| Device Code events | OnDeviceCode, OnDeviceCodeExpired | Delivers the user code and verification URI to display, and fires if the user does not complete authorization in time. |
TsgcHTTP_JWT_Client implements RFC 7519 (JSON Web Token), RFC 7515 (JWS) and RFC 7516 (JWE) through a single JWTOptions property.
| Capability | API | Notes |
|---|---|---|
| Header | JWTOptions.Header.alg, typ, kid | The JOSE header. alg selects jwtHS256/384/512, jwtRS256/384/512 or jwtES256/384/512; extra fields go through Header.AddKeyValue. |
| Payload / claims | JWTOptions.Payload.iss, sub, aud, exp, nbf, iat, jti | The registered RFC 7519 claims; custom claims are added with Payload.AddKeyValue. |
| Signing key material | JWTOptions.Algorithms.HS.Secret, RS.PrivateKey, ES.PrivateKey | Shared secret for HMAC, PEM-encoded private key for RSA or ECDSA, selected by Header.alg. |
| Auto-refresh | JWTOptions.RefreshTokenAfter | When greater than zero, Sign refreshes iat and recomputes exp automatically; 0 regenerates the token on every request. |
| Sign standalone | Sign | Builds, signs and returns the encoded token (header.payload.signature) as a single string, no HTTP or WebSocket client required. |
| Attach to a client | Start, Client.Authentication.Token.JWT | Start signs the configured JWT and delivers it as a Bearer token to the host component; set it once on Authentication.Token.JWT and every request goes out signed. |
| Works with | TsgcWebSocketClient, TsgcHTTP1Client, TsgcHTTP2Client | Any of the three accepts a TsgcHTTP_JWT_Client as its Bearer token source through Authentication.Token. |
| OpenSSL configuration | JWTOptions.OpenSSL_Options | API version and library path used by the RS and ES algorithms (APIVersion, LibPath, LibPathCustom, UnixSymLinks). |
WebAuthn is part of the sgcAuth story, but it is not a third registered component in this pack. It is served by the sgcWebSockets WebAuthn server, and it needs sgcCustomIndy underneath.
| Area | Detail |
|---|---|
| What it is | W3C Web Authentication Level 2 (WebAuthn): passwordless sign-in with passkeys and FIDO2 security keys, backed by TsgcWSAPIServer_WebAuthn. |
| Where it lives | TsgcWSAPIServer_WebAuthn is a server-side component, part of sgcWebSockets Enterprise and All-Access, not a client registered by this pack. |
| What it needs | The patched Indy build that sgcCustomIndy ships as an add-on for sgcWebSockets Core. |
| How it is added | The order page adds sgcCustomIndy to your cart automatically when you order sgcAuth. Already own a license? Remove the line at checkout, no extra charge either way. |
| Client side | A browser-side JavaScript application drives the WebAuthn ceremony; sgcHTML ships a ready-made WebAuthn login UI component that pairs with the server. |
Standards-track specs, and the same source across every supported compiler.
| Area | Detail |
|---|---|
| OAuth2 standards | OAuth 2.0 (RFC 6749), PKCE (RFC 7636), Device Authorization Grant (RFC 8628), Token Revocation (RFC 7009), Token Introspection (RFC 7662), DPoP (RFC 9449). |
| JWT standards | JSON Web Token (RFC 7519), JSON Web Signature (RFC 7515), JSON Web Encryption (RFC 7516). |
| WebAuthn standard | Web Authentication Level 2 (W3C), via the sgcWebSockets WebAuthn server. |
| Platforms | Both clients are plain HTTPS and local signing, so every Delphi platform is covered: Windows Win32/Win64, Linux 64-bit, macOS, iOS and Android. |
| Compilers | Delphi and C++ Builder 7 through 13. |
| Editions | The OAuth2 Client and JWT Client also ship inside sgcWebSockets from Standard up, and All-Access includes everything. |
| Licensing | Standalone. The sgcWebSockets Core runtime is bundled in and full source code is included. |