Delphi OAuth2 Client
OAuth 2.0 / OAuth 2.1 client component — Authorization Code with PKCE, Client Credentials, Device Code, refresh-token rotation and built-in browser flow.
OAuth 2.0 / OAuth 2.1 client component — Authorization Code with PKCE, Client Credentials, Device Code, refresh-token rotation and built-in browser flow.
Implements the OAuth 2.0 / 2.1 client side — covers Authorization Code (with PKCE), Client Credentials, Device Code and refresh-token flows. Includes a tiny embedded HTTP listener for the redirect URI.
TsgcHTTP_OAuth2_Client
Windows, macOS, Linux, iOS, Android
Standard / Professional / Enterprise
Configure ClientId / ClientSecret / Scope / Endpoints (or use a Provider preset for Google / Microsoft / GitHub), call Start, then use Token in your HTTP calls.
uses
sgcHTTP, sgcHTTP_OAuth_Types;
// OAuth2 is a form field: OAuth2: TsgcHTTP_OAuth2_Client;
procedure TForm1.Authorize;
begin
OAuth2 := TsgcHTTP_OAuth2_Client.Create(nil);
OAuth2.OnAfterAccessToken := OnAfterAccessTokenEvent;
OAuth2.OAuth2Options.GrantType := auth2CodePKCE;
OAuth2.OAuth2Options.ClientId := 'your-client-id';
OAuth2.OAuth2Options.ClientSecret := 'your-client-secret';
OAuth2.AuthorizationServerOptions.AuthURL := 'https://auth.example.com/authorize';
OAuth2.AuthorizationServerOptions.TokenURL := 'https://auth.example.com/token';
OAuth2.AuthorizationServerOptions.Scope.Clear;
OAuth2.AuthorizationServerOptions.Scope.Add('profile');
OAuth2.AuthorizationServerOptions.Scope.Add('email');
OAuth2.LocalServerOptions.IP := '127.0.0.1';
OAuth2.LocalServerOptions.Port := 5555;
OAuth2.LocalServerOptions.RedirectURL := 'http://localhost:5555/callback';
// Spawns the user browser at the auth URL and returns immediately
OAuth2.Start;
end;
// ... the user logs in, the browser is redirected to the callback URL,
// ... the component captures the code and exchanges it for tokens
procedure TForm1.OnAfterAccessTokenEvent(Sender: TObject; const Access_Token,
Token_Type, Expires_In, Refresh_Token, Scope, RawParams: String;
var Handled: Boolean);
begin
ShowMessage(Access_Token);
end;// uses: sgcHTTP, sgcHTTP_OAuth_Types
TsgcHTTP_OAuth2_Client *OAuth2 = new TsgcHTTP_OAuth2_Client(this);
OAuth2->OnAfterAccessToken = OnAfterAccessTokenEvent;
OAuth2->OAuth2Options->GrantType = auth2CodePKCE;
OAuth2->OAuth2Options->ClientId = "your-client-id";
OAuth2->OAuth2Options->ClientSecret = "your-client-secret";
OAuth2->AuthorizationServerOptions->AuthURL = "https://auth.example.com/authorize";
OAuth2->AuthorizationServerOptions->TokenURL = "https://auth.example.com/token";
OAuth2->AuthorizationServerOptions->Scope->Clear();
OAuth2->AuthorizationServerOptions->Scope->Add("profile");
OAuth2->AuthorizationServerOptions->Scope->Add("email");
OAuth2->LocalServerOptions->IP = "127.0.0.1";
OAuth2->LocalServerOptions->Port = 5555;
OAuth2->LocalServerOptions->RedirectURL = "http://localhost:5555/callback";
OAuth2->Start();Implements the OAuth 2.0 client surface with PKCE, refresh-token rotation and an embedded loopback redirect listener.
Authorization Code (with optional PKCE per RFC 7636), Client Credentials (RFC 6749 §4.4), Device Code (RFC 8628) and Refresh Token (RFC 6749 §6) are all supported as typed methods.
Set OAuth2Options.GrantType to auth2CodePKCE, the component generates the code_verifier / code_challenge pair and includes them per RFC 7636 (mandatory in OAuth 2.1).
Sibling components TsgcHTTP_OAuth2_Client_Google and TsgcHTTP_OAuth2_Client_Microsoft ship with the right endpoints and scopes pre-filled. Use the base class for everyone else.
The component spins up a tiny embedded HTTP listener on the configured RedirectURL, captures the authorization code, then shuts the listener down — no external web server required.
Read CurrentRefreshToken after the authorization and store it yourself, then call Refresh at the next launch so the user is not prompted again.
Pair with TsgcHTTPClient, TsgcHTTP2Client or TsgcWebSocketClient via Authentication.Token.OAuth — the bearer token is injected on every request automatically.
Authoritative sources for the standards this component implements.
Deep-link to the component reference, grab the ready-to-run demo project, and download the trial.
| Online Help — TsgcHTTP_OAuth2_Client Full property, method and event reference for this component. | Open | |
| Demo Project — Demos\20.HTTP_Protocol\02.OAuth2_Authentication Ready-to-run example project. Ships inside the sgcWebSockets package — download the trial below. | Open | |
| Technical Document (PDF) Features, quick start, code samples for Delphi & C++ Builder and primary-source references — this component only. | Open | |
| User Manual (PDF) Comprehensive manual covering every component in the library. | Open |