---
product: Chilkat
product_version: 11.7.0
language: pascal
language_label: Lazarus Pascal
class: AuthAzureSAS
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/pascal_AuthAzureSASRef.html
---
# Chilkat AuthAzureSAS — Lazarus Pascal — v11.7.0

> Chilkat 11.7.0 · language=pascal · class=AuthAzureSAS
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/AuthAzureSAS.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`.

## Purpose

**Create Azure Shared Access Signature tokens for signed Azure Storage requests.**

`Chilkat.AuthAzureSAS` creates Azure Shared Access Signature authentication tokens. It defines the SAS string-to-sign, supplies the Azure Storage account access key used to compute the signature, and controls which parameters are included in the generated SAS token query string. The resulting token can be used with `Chilkat.Rest`, `Chilkat.Http`, or other request-building code that needs time-limited, permission-scoped access to Azure Storage resources.

**SAS token generation**

Generate a signed query-string token that authorizes limited access to an Azure Storage resource.

**String-to-sign control**

Provide the exact Azure SAS string-to-sign required for the storage service and resource being accessed.

**Account key signing**

Use the Azure Storage account access key to compute the signature placed in the generated SAS token.

**Token parameters**

Add signed SAS parameters such as permissions, expiry, resource type, API version, protocol, or IP restrictions.

**Non-token parameters**

Add query parameters that should accompany the request but should not be included as part of the SAS token itself.

**REST integration**

Use the generated SAS query string with Azure Storage requests built using `Chilkat.Rest` or other Chilkat HTTP workflows.

**Common pattern:** Create an `AuthAzureSAS` object, set the Azure Storage `AccessKey`, provide the required `StringToSign`, add SAS token parameters with `SetTokenParam`, add any extra query parameters with `SetNonTokenParam`, then call `GenerateToken`. Use `AuthAzureSAS` when you need a SAS query token; use `Chilkat.AuthAzureStorage` when you need Shared Key authorization headers instead.

For an extended overview, see [AuthAzureSAS Class Overview](https://www.chilkatsoft.com/authazuresas_class_overview.asp).

## Object creation, unlocking and error handling

**Create / Free**

```pascal
uses
  Chilkat.AuthAzureSAS;

var
  obj: TAuthAzureSAS;
begin
  obj := TAuthAzureSAS.Create;
  try
    if not obj.IsValid then
      raise Exception.Create('Failed to create a TAuthAzureSAS instance.');

    // ... use obj ...

  finally
    obj.Free;
  end;
end;
```

`constructor Create;`

Allocates the underlying CkAuthAzureSAS object and returns a new TAuthAzureSAS instance. Simply adding **Chilkat.AuthAzureSAS** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed).

`destructor Destroy; override;`

Every TAuthAzureSAS created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkAuthAzureSAS handle. A native (unmanaged) memory leak occurs if the object is never freed.

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `AccessKey` | property, read/write | `property AccessKey: string read GetAccessKey write SetAccessKey;` |
| `StringToSign` | property, read/write | `property StringToSign: string read GetStringToSign write SetStringToSign;` |
| `Clear` | method | `procedure Clear;` |
| `GenerateToken` | method | `function GenerateToken: string;` |
| `SetNonTokenParam` | method | `function SetNonTokenParam(const name: string;     const value: string): Boolean;` |
| `SetTokenParam` | method | `function SetTokenParam(const name: string;     const authParamName: string;     const value: string): Boolean;` |

## Properties

### AuthAzureSAS.AccessKey

`Chilkat 11.7.0 · pascal · AuthAzureSAS · AccessKey · property · read/write · since 9.5.0.65`

```pascal
property AccessKey: string read GetAccessKey write SetAccessKey;
```

This is the signing key (access key) that must be kept private. It is a base64 string such as `abdTvCZFFoWUyre6erlNN+IOb9qhXgDsyhrxmZvpmxqFDwpl9oD0X9Fy0hIQa6L5UohznRLmkCtUYySO4Y2eaw==`

### AuthAzureSAS.StringToSign

`Chilkat 11.7.0 · pascal · AuthAzureSAS · StringToSign · property · read/write · since 9.5.0.65`

```pascal
property StringToSign: string read GetStringToSign write SetStringToSign;
```

**Full documentation for this property (same in every language):** [Explaining Azure SAS Tokens](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/azure_sas_tokens_for_authentication.md)

Defines the format of the string to sign.

The format is specified as a comma-separated list of names. For example:

```
signedpermissions,signedstart,signedexpiry,canonicalizedresource,signedidentifier,signedIP,signedProtocol,signedversion,rscc,rscd,rsce,rscl,rsct
```

This will result in an actual string-to-sign that is composed of the values for each name separated by newline (LF) chars. For example:

```
signedpermissions + \n +  
signedstart + \n +  
signedexpiry + \n +  
canonicalizedresource + \n +  
signedidentifier + \n +  
signedIP + \n +  
signedProtocol + \n +  
signedversion + \n +  
rscc + \n +  
rscd + \n +  
rsce + \n +  
rscl + \n +  
rsct
```

## Methods

### AuthAzureSAS.Clear

`Chilkat 11.7.0 · pascal · AuthAzureSAS · Clear · method · since 9.5.0.65`

```pascal
procedure Clear;
```

Clears all params set by the methods SetNonTokenParam and SetTokenParam.

### AuthAzureSAS.GenerateToken

`Chilkat 11.7.0 · pascal · AuthAzureSAS · GenerateToken · method · since 9.5.0.65`

```pascal
function  GenerateToken: string;
```

**Full documentation for this method (same in every language):** [Explaining Azure SAS Tokens](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/azure_sas_tokens_for_authentication.md)

Generates and returns the SAS token based on the defined `StringToSign` and params.

Returns True for success, False for failure.

### AuthAzureSAS.SetNonTokenParam

`Chilkat 11.7.0 · pascal · AuthAzureSAS · SetNonTokenParam · method · since 9.5.0.65`

```pascal
function  SetNonTokenParam(const name: string;
    const value: string): Boolean;
```

Adds a non-token parameter name/value. This is a value that is included in the string to sign, but is NOT included in the token query params.

Returns True for success, False for failure.

### AuthAzureSAS.SetTokenParam

`Chilkat 11.7.0 · pascal · AuthAzureSAS · SetTokenParam · method · since 9.5.0.65`

```pascal
function  SetTokenParam(const name: string;
    const authParamName: string;
    const value: string): Boolean;
```

Adds a token parameter name/value. This is a value that is included in the string to sign, and is also included in the token query params.

Returns True for success, False for failure.