---
product: Chilkat
product_version: 11.7.0
language: pascal
language_label: Lazarus Pascal
class: OAuth2
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/pascal_OAuth2Ref.html
---
# Chilkat OAuth2 — Lazarus Pascal — v11.7.0

> Chilkat 11.7.0 · language=pascal · class=OAuth2
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/OAuth2.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`.

## Purpose

OAuth2 Authorization Code Flow

**Obtain OAuth2 access tokens from desktop and native applications**

The `Chilkat.OAuth2` class enables desktop and native applications to perform the OAuth 2.0 Authorization Code Flow for obtaining an initial access token. The flow begins with `StartAuth`, which generates the authorization URL to open in a browser and starts a background listener for the local redirect callback.

**Browser-based authorization** Use `LaunchBrowser` to open the generated authorization URL.

**Local redirect handling** Chilkat listens locally for the provider’s redirect response.

**Token exchange** The authorization code is exchanged for access and refresh tokens.

**Diagnostics and state** Inspect `AuthFlowState`, `FailureInfo`, and token response data.

After the user grants or denies authorization, Chilkat captures the redirect response, completes the token exchange, and makes the results available through properties such as `AccessToken`, `RefreshToken`, `AccessTokenResponse`, `AuthFlowState`, and `FailureInfo`.

The class also supports PKCE, refresh-token requests, custom authorization and token parameters, secure OS-backed secret resolution, and detailed diagnostic information.

**Note:** This class is primarily used to obtain the initial OAuth2 access token. After that, applications typically use the refresh token to obtain new access tokens for an extended period without requiring further user interaction.

For an extended overview, see [OAuth2 Class Overview](https://www.chilkatsoft.com/oauth2_class_overview.asp).

## Object creation, unlocking and error handling

**Create / Free**

```pascal
uses
  Chilkat.OAuth2;

var
  obj: TOAuth2;
begin
  obj := TOAuth2.Create;
  try
    if not obj.IsValid then
      raise Exception.Create('Failed to create a TOAuth2 instance.');

    // ... use obj ...

  finally
    obj.Free;
  end;
end;
```

`constructor Create;`

Allocates the underlying CkOAuth2 object and returns a new TOAuth2 instance. Simply adding **Chilkat.OAuth2** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed).

`destructor Destroy; override;`

Every TOAuth2 created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkOAuth2 handle. A native (unmanaged) memory leak occurs if the object is never freed.

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `AccessToken` | property, read/write | `property AccessToken: string read GetAccessToken write SetAccessToken;` |
| `AccessTokenResponse` | property, read-only | `property AccessTokenResponse: string read GetAccessTokenResponse;` |
| `AppCallbackUrl` | property, read/write | `property AppCallbackUrl: string read GetAppCallbackUrl write SetAppCallbackUrl;` |
| `AuthFlowState` | property, read-only | `property AuthFlowState: Integer read GetAuthFlowState;` |
| `AuthorizationEndpoint` | property, read/write | `property AuthorizationEndpoint: string read GetAuthorizationEndpoint write SetAuthorizationEndpoint;` |
| `ClientId` | property, read/write | `property ClientId: string read GetClientId write SetClientId;` |
| `ClientSecret` | property, read/write | `property ClientSecret: string read GetClientSecret write SetClientSecret;` |
| `CodeChallenge` | property, read/write | `property CodeChallenge: Boolean read GetCodeChallenge write SetCodeChallenge;` |
| `CodeChallengeMethod` | property, read/write | `property CodeChallengeMethod: string read GetCodeChallengeMethod write SetCodeChallengeMethod;` |
| `EnableSecrets` | property, read/write | `property EnableSecrets: Boolean read GetEnableSecrets write SetEnableSecrets;` |
| `FailureInfo` | property, read-only | `property FailureInfo: string read GetFailureInfo;` |
| `IncludeNonce` | property, read/write | `property IncludeNonce: Boolean read GetIncludeNonce write SetIncludeNonce;` |
| `ListenPort` | property, read/write | `property ListenPort: Integer read GetListenPort write SetListenPort;` |
| `ListenPortRangeEnd` | property, read/write | `property ListenPortRangeEnd: Integer read GetListenPortRangeEnd write SetListenPortRangeEnd;` |
| `ListenPortSelected` | property, read-only | `property ListenPortSelected: Integer read GetListenPortSelected;` |
| `LocalHost` | property, read/write | `property LocalHost: string read GetLocalHost write SetLocalHost;` |
| `NonceLength` | property, read/write | `property NonceLength: Integer read GetNonceLength write SetNonceLength;` |
| `Oob` | property, read/write | `property Oob: Boolean read GetOob write SetOob;` |
| `RedirectAllowHtml` | property, read/write | `property RedirectAllowHtml: string read GetRedirectAllowHtml write SetRedirectAllowHtml;` |
| `RedirectDenyHtml` | property, read/write | `property RedirectDenyHtml: string read GetRedirectDenyHtml write SetRedirectDenyHtml;` |
| `RedirectReqReceived` | property, read-only | `property RedirectReqReceived: string read GetRedirectReqReceived;` |
| `RefreshToken` | property, read/write | `property RefreshToken: string read GetRefreshToken write SetRefreshToken;` |
| `Resource` | property, read/write | `property Resource: string read GetResource write SetResource;` |
| `ResponseMode` | property, read/write | `property ResponseMode: string read GetResponseMode write SetResponseMode;` |
| `ResponseType` | property, read/write | `property ResponseType: string read GetResponseType write SetResponseType;` |
| `Scope` | property, read/write | `property Scope: string read GetScope write SetScope;` |
| `StateParam` | property, read/write | `property StateParam: string read GetStateParam write SetStateParam;` |
| `TokenEndpoint` | property, read/write | `property TokenEndpoint: string read GetTokenEndpoint write SetTokenEndpoint;` |
| `TokenType` | property, read/write | `property TokenType: string read GetTokenType write SetTokenType;` |
| `UncommonOptions` | property, read/write | `property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions;` |
| `UseBasicAuth` | property, read/write | `property UseBasicAuth: Boolean read GetUseBasicAuth write SetUseBasicAuth;` |
| `AddAuthQueryParam` | method | `function AddAuthQueryParam(const name: string;     const value: string): Boolean;` |
| `AddRefreshQueryParam` | method | `function AddRefreshQueryParam(const name: string;     const value: string): Boolean;` |
| `AddTokenQueryParam` | method | `function AddTokenQueryParam(const name: string;     const value: string): Boolean;` |
| `Cancel` | method | `function Cancel: Boolean;` |
| `ExchangeCodeForToken` | method | `function ExchangeCodeForToken(const code: string): Boolean;` |
| `GetAccessTokenResponseSb` | method | `// sb is a TStringBuilder object. function GetAccessTokenResponseSb(sb: TChilkatBase): Boolean;` |
| `GetRedirectRequestParam` | method | `function GetRedirectRequestParam(const paramName: string): string;` |
| `LaunchBrowser` | method | `function LaunchBrowser(const url: string): Boolean;` |
| `LoadTaskCaller` | method | `// task is a TTask object. function LoadTaskCaller(task: TChilkatBase): Boolean;` |
| `RefreshAccessToken` | method | `function RefreshAccessToken: Boolean;` |
| `SetRefreshHeader` | method | `function SetRefreshHeader(const name: string;     const value: string): Boolean;` |
| `SleepMs` | method | `procedure SleepMs(millisec: Integer);` |
| `StartAuth` | method | `function StartAuth: string;` |
| `UseConnection` | method | `// sock is a TSocket object. function UseConnection(sock: TChilkatBase): Boolean;` |

## Properties

### OAuth2.AccessToken

`Chilkat 11.7.0 · pascal · OAuth2 · AccessToken · property · read/write · since 9.5.0.59`

```pascal
property AccessToken: string read GetAccessToken write SetAccessToken;
```

Contains the `access_token` extracted from the most recent successful token response. It is updated after a successful authorization-code exchange or refresh-token request.

The access token is presented to the protected API, commonly in an HTTP header:

```
Authorization: Bearer ACCESS_TOKEN
```

**Bearer credential:** Anyone possessing a bearer access token can use the authority it grants until the token expires or is revoked. Store it securely, transmit it only over TLS, and never place it in a URL or ordinary log.

### OAuth2.AccessTokenResponse

`Chilkat 11.7.0 · pascal · OAuth2 · AccessTokenResponse · property · read-only · since 9.5.0.59`

```pascal
property AccessTokenResponse: string read GetAccessTokenResponse;
```

Contains the raw response body returned by the token endpoint after a successful authorization-code exchange or refresh-token request.

Most providers return JSON similar to:

```
{
  "token_type": "Bearer",
  "expires_in": 3600,
  "access_token": "...",
  "scope": "read write",
  "refresh_token": "..."
}
```

| Field | Typical meaning |
| :--- | :--- |
| `access_token` | Credential presented to the protected API. |
| `token_type` | Usually `Bearer`. |
| `expires_in` | Access-token lifetime in seconds, when supplied. |
| `scope` | Scopes actually granted, when supplied. |
| `refresh_token` | Credential used to request later access tokens, when issued. |
| `id_token` | OpenID Connect identity token, when requested and issued. |

Some providers return form-encoded text instead of JSON. Use `GetAccessTokenResponseSb` when a `StringBuilder` destination is preferred.

**Sensitive response:** This property can contain live credentials. Do not include it in ordinary logs, exception reports, telemetry, or user-visible diagnostics.

### OAuth2.AppCallbackUrl

`Chilkat 11.7.0 · pascal · OAuth2 · AppCallbackUrl · property · read/write · since 9.5.0.73`

```pascal
property AppCallbackUrl: string read GetAppCallbackUrl write SetAppCallbackUrl;
```

**Full documentation for this property (same in every language):** [Using Your Web Server as an Intermediary for OAuth2 Redirect to localhost.](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_intermediary_public_web_server.md)

Specifies a public HTTPS callback URL on an application-controlled web server when the provider will not redirect directly to `localhost` or a loopback IP address.

The intermediary endpoint receives the provider's redirect and forwards the complete callback, including `code`, `state`, `error`, and any provider-specific parameters, to the local listener used by Chilkat.

**Security responsibility:** The intermediary handles a short-lived authorization code and state value. It must use HTTPS, avoid logging sensitive query data, validate and preserve parameters correctly, and prevent use as an open redirect.

**Use only when necessary:** A direct loopback redirect with PKCE is simpler and avoids introducing a public relay. Prefer it whenever the provider supports native-application loopback redirects.

### OAuth2.AuthFlowState

`Chilkat 11.7.0 · pascal · OAuth2 · AuthFlowState · property · read-only · since 9.5.0.59`

```pascal
property AuthFlowState: Integer read GetAuthFlowState;
```

Reports the current state of the background authorization flow.

| Value | State | Meaning |
| :--- | :--- | :--- |
| `0` | Idle | No authorization flow has been started. |
| `1` | Waiting for redirect | The local listener is waiting for the browser callback. |
| `2` | Exchanging code | The redirect was received and the background thread is waiting for the token-endpoint response. |
| `3` | Success | The flow completed and token response properties are available. |
| `4` | Denied | The authorization server returned an access-denied response. Inspect `AccessTokenResponse`. |
| `5` | Failed | The flow failed before successful completion. Inspect `FailureInfo` and `LastErrorText`. |

**Polling pattern:** After opening the authorization URL, periodically read this property until it is `3`, `4`, or `5`. Avoid a tight loop; sleep briefly or use the host environment's timer mechanism.

### OAuth2.AuthorizationEndpoint

`Chilkat 11.7.0 · pascal · OAuth2 · AuthorizationEndpoint · property · read/write · since 9.5.0.59`

```pascal
property AuthorizationEndpoint: string read GetAuthorizationEndpoint write SetAuthorizationEndpoint;
```

Specifies the authorization endpoint to which the user's browser is directed. `StartAuth` appends the client identifier, redirect URI, scope, state, PKCE values, and other configured authorization parameters.

| Provider | Authorization endpoint | Token endpoint |
| :--- | :--- | :--- |
| Google | `https://accounts.google.com/o/oauth2/v2/auth` | `https://oauth2.googleapis.com/token` |
| Microsoft identity platform | `https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize` | `https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token` |
| Salesforce production | `https://login.salesforce.com/services/oauth2/authorize` | `https://login.salesforce.com/services/oauth2/token` |
| QuickBooks Online | `https://appcenter.intuit.com/connect/oauth2` | `https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer` |
| X API | `https://x.com/i/oauth2/authorize` | `https://api.x.com/2/oauth2/token` |

**Prefer provider metadata:** When the provider publishes OAuth authorization-server metadata or OpenID Connect discovery metadata, use its current `authorization_endpoint` value rather than copying an endpoint from an old example.

**Environment and tenant matter:** Sandbox, production, regional, and tenant-specific deployments can use different endpoints. The authorization and token endpoints must belong to the same provider environment.

### OAuth2.ClientId

`Chilkat 11.7.0 · pascal · OAuth2 · ClientId · property · read/write · since 9.5.0.59`

```pascal
property ClientId: string read GetClientId write SetClientId;
```

**Full documentation for this property (same in every language):** [Explaining the OAuth2 Client ID](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_client_id.md)

Specifies the client identifier assigned when the application is registered with the authorization server. It identifies the application in authorization and token requests.

**Not a password:** A client ID is normally public and may appear in authorization URLs. Its security role is identification, not authentication.

### OAuth2.ClientSecret

`Chilkat 11.7.0 · pascal · OAuth2 · ClientSecret · property · read/write · since 9.5.0.59`

```pascal
property ClientSecret: string read GetClientSecret write SetClientSecret;
```

**Full documentation for this property (same in every language):** [Explaining the OAuth2 Client Secret](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_client_secret.md)

Specifies the client secret assigned to a confidential client by the authorization server. It is used when the provider requires the client to authenticate at the token endpoint.

**Protect this value:** A client secret is a credential. Do not place it in source control, logs, browser URLs, or distributable desktop/mobile binaries. Native applications are public clients and generally cannot keep a shared secret confidential; use PKCE and follow the provider's registration requirements.

**PKCE is separate:** PKCE protects the authorization code. It does not transform an embedded secret into a confidential credential and does not replace client authentication for a provider that requires it.

### OAuth2.CodeChallenge

`Chilkat 11.7.0 · pascal · OAuth2 · CodeChallenge · property · read/write · since 9.5.0.59`

```pascal
property CodeChallenge: Boolean read GetCodeChallenge write SetCodeChallenge;
```

**Full documentation for this property (same in every language):** [OAuth2  Proof Key for Code Exchange (PKCE) Explained](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_pkce.md)

Set to `True` to enable Proof Key for Code Exchange (PKCE) for the authorization-code flow. The default is `False`.

When enabled, Chilkat generates a high-entropy code verifier, sends its transformed challenge in the authorization request, and sends the original verifier during the token exchange.

**Recommended for native applications:** PKCE binds the authorization code to the application instance that initiated the flow, reducing the risk that an intercepted code can be redeemed by another client. Current OAuth security guidance requires PKCE for public clients and recommends it broadly.

### OAuth2.CodeChallengeMethod

`Chilkat 11.7.0 · pascal · OAuth2 · CodeChallengeMethod · property · read/write · since 9.5.0.59`

```pascal
property CodeChallengeMethod: string read GetCodeChallengeMethod write SetCodeChallengeMethod;
```

**Full documentation for this property (same in every language):** [OAuth2  Proof Key for Code Exchange (PKCE) Explained](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_pkce.md)

Selects the PKCE transformation used when `CodeChallenge` is `True`.

| Value | Behavior |
| :--- | :--- |
| `S256` | Sends a Base64URL-encoded SHA-256 digest of the code verifier. This is the default and recommended method. |
| `plain` | Sends the code verifier itself as the challenge. Use only for compatibility with a provider that cannot support `S256`. |

**Avoid downgrading:** If a provider rejects `S256`, do not automatically retry with `plain` unless the provider is known and explicitly requires it.

### OAuth2.EnableSecrets

`Chilkat 11.7.0 · pascal · OAuth2 · EnableSecrets · property · read/write · since 11.5.0`

```pascal
property EnableSecrets: Boolean read GetEnableSecrets write SetEnableSecrets;
```

**Full documentation for this property (same in every language):** [More Detailed Information About EnableSecrets](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/secret_specification_strings.md)

Controls automatic resolution of selected values from operating-system secure storage. The default is `False`.

When `True`, the following properties may contain a secret specification beginning with `!!` instead of a literal value:

- `AuthorizationEndpoint`
- `TokenEndpoint`
- `ClientId`
- `ClientSecret`

The specification has the form:

```
!![appName|]service[|domain]|username
```

Chilkat resolves the value through Windows Credential Manager on Windows or Apple Keychain on macOS.

**Purpose:** Secret specifications allow deployment-specific values to remain outside source code and configuration files. Although endpoints and client IDs are not normally secret, resolving them the same way can centralize application configuration.

**Platform availability:** This feature depends on supported operating-system credential storage. Ensure the named credential exists and that the process identity has permission to read it.

### OAuth2.FailureInfo

`Chilkat 11.7.0 · pascal · OAuth2 · FailureInfo · property · read-only · since 9.5.0.59`

```pascal
property FailureInfo: string read GetFailureInfo;
```

Contains diagnostic information when `AuthFlowState` is `5`. The value is cleared when `StartAuth` begins a new flow.

Use this property for failures in the listener, redirect processing, network connection, or token exchange. Provider-declared authorization denial is represented by state `4` and is normally available in `AccessTokenResponse`.

**Review before logging:** Diagnostics can include URLs, response bodies, or request details. Remove authorization codes, tokens, client credentials, and personal information before storing or transmitting logs.

### OAuth2.IncludeNonce

`Chilkat 11.7.0 · pascal · OAuth2 · IncludeNonce · property · read/write · since 9.5.0.78`

```pascal
property IncludeNonce: Boolean read GetIncludeNonce write SetIncludeNonce;
```

Set to `True` to include an OpenID Connect `nonce` parameter in the authorization request. The nonce is generated by Chilkat using the byte length specified by `NonceLength`. The default is `False`.

In OpenID Connect, the authorization server includes the nonce in the ID token so the client can associate that token with the authorization request and detect replay or token-substitution problems.

**Nonce versus state:** `nonce` protects the relationship between an OpenID Connect request and its ID token. OAuth `state` correlates the browser callback with the initiating request and is used for CSRF protection. They are related security controls but are not interchangeable.

### OAuth2.ListenPort

`Chilkat 11.7.0 · pascal · OAuth2 · ListenPort · property · read/write · since 9.5.0.59`

```pascal
property ListenPort: Integer read GetListenPort write SetListenPort;
```

Specifies the local TCP port on which Chilkat listens for the browser's OAuth redirect. Choose an available nonprivileged port, typically between `1024` and `65535`.

The redirect URI registered with the provider must match the host, selected port, and terminating slash generated by this object. For example:

```
http://127.0.0.1:3017/
```

- Use `http` for a loopback redirect handled entirely on the local computer.
- Use `LocalHost` to select `localhost` or `127.0.0.1`.
- Include the final `/` when registering the redirect URI.

**Provider registration must match:** Authorization servers differ in their support for loopback ports and redirect-URI matching. Register the exact form required by the provider. The IPv4 loopback literal `127.0.0.1` is generally more predictable than resolving `localhost`.

### OAuth2.ListenPortRangeEnd

`Chilkat 11.7.0 · pascal · OAuth2 · ListenPortRangeEnd · property · read/write · since 9.5.0.69`

```pascal
property ListenPortRangeEnd: Integer read GetListenPortRangeEnd write SetListenPortRangeEnd;
```

Defines the inclusive end of a local-listener port range that begins with `ListenPort`. The default value of `0` disables range selection and uses only `ListenPort`.

When nonzero, Chilkat selects an available port in the inclusive range. For example, `ListenPort=55110` and `ListenPortRangeEnd=55117` permit ports `55110` through `55117`.

**Redirect registration:** The provider must accept the selected redirect URI. If it requires every exact port to be pre-registered, register each port in the range. If the provider supports the native-app loopback convention with a variable port, follow its documented registration form.

Read `ListenPortSelected` to determine which port was used.

### OAuth2.ListenPortSelected

`Chilkat 11.7.0 · pascal · OAuth2 · ListenPortSelected · property · read-only · since 9.5.0.94`

```pascal
property ListenPortSelected: Integer read GetListenPortSelected;
```

Returns the local port selected for the current or most recently completed authorization flow.

When a range is configured with `ListenPortRangeEnd`, use this value to determine the actual loopback redirect port. It is also available for the `{listenPort}` substitution supported by `StateParam`.

### OAuth2.LocalHost

`Chilkat 11.7.0 · pascal · OAuth2 · LocalHost · property · read/write · since 9.5.0.59`

```pascal
property LocalHost: string read GetLocalHost write SetLocalHost;
```

**Full documentation for this property (same in every language):** [Why 127.0.0.1 is Preferable to localhost for the OAuth2 Redirect URL](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/localhost_vs_loopback_for_OAuth2_redirect.md)

Selects the host name used in the loopback redirect URI:

| Value | Redirect form |
| :--- | :--- |
| `localhost` | `http://localhost:{port}/` |
| `127.0.0.1` | `http://127.0.0.1:{port}/` |

The default is `localhost`. The value must match the redirect URI registered with the provider.

**Loopback recommendation:** `127.0.0.1` avoids DNS and hosts-file ambiguity and is generally preferable when the provider accepts an IPv4 loopback-literal redirect.

### OAuth2.NonceLength

`Chilkat 11.7.0 · pascal · OAuth2 · NonceLength · property · read/write · since 9.5.0.80`

```pascal
property NonceLength: Integer read GetNonceLength write SetNonceLength;
```

Specifies the number of random bytes used to generate the hexadecimal OpenID Connect nonce when `IncludeNonce` is `True`. The resulting string contains two hexadecimal characters per byte.

The default is `4` bytes, which produces an 8-character hexadecimal nonce.

**Entropy matters:** For security-sensitive OpenID Connect use, consider a substantially larger nonce, such as 16 bytes or more, unless the provider imposes a different requirement.

### OAuth2.Oob

`Chilkat 11.7.0 · pascal · OAuth2 · Oob · property · read/write · since 10.0.2`

```pascal
property Oob: Boolean read GetOob write SetOob;
```

**Full documentation for this property (same in every language):** [About OAuth2 OOB (Out-of-Band) Flow](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_oob_flow.md)

Set to `True` to use the legacy out-of-band redirect URI `urn:ietf:wg:oauth:2.0:oob`. The application must obtain the displayed authorization code and pass it to `ExchangeCodeForToken`. The default is `False`.

**Legacy and often unsupported:** OOB authorization exposes a code for manual copy/paste and is no longer accepted by many providers. For desktop applications, use a loopback redirect with PKCE whenever possible.

### OAuth2.RedirectAllowHtml

`Chilkat 11.7.0 · pascal · OAuth2 · RedirectAllowHtml · property · read/write · since 9.5.0.59`

```pascal
property RedirectAllowHtml: string read GetRedirectAllowHtml write SetRedirectAllowHtml;
```

Gets or sets the HTML response sent by Chilkat's local listener to the browser after authorization is granted and the redirect is accepted.

The default HTML immediately redirects the browser to Chilkat's confirmation page:

```
<html>
  <head><meta http-equiv='refresh'
    content='0;url=https://www.chilkatsoft.com/oauth2_allowed.html'></head>
  <body>Thank you for allowing access.</body>
</html>
```

Replace this value to display application-specific instructions or redirect to a page operated by your organization.

**Do not expose credentials:** The HTML is shown in a browser. Do not insert the authorization code, access token, refresh token, client secret, or raw callback URL into this page.

### OAuth2.RedirectDenyHtml

`Chilkat 11.7.0 · pascal · OAuth2 · RedirectDenyHtml · property · read/write · since 9.5.0.59`

```pascal
property RedirectDenyHtml: string read GetRedirectDenyHtml write SetRedirectDenyHtml;
```

Gets or sets the HTML response sent by Chilkat's local listener to the browser when the authorization server reports that access was denied.

The default HTML immediately redirects the browser to Chilkat's denial page:

```
<html>
  <head><meta http-equiv='refresh'
    content='0;url=https://www.chilkatsoft.com/oauth2_denied.html'></head>
  <body>The app will not have access.</body>
</html>
```

Replace this value to display application-specific instructions or redirect to a page operated by your organization.

**Denial is not a transport failure:** User denial is represented by `AuthFlowState` value `4`. It should normally be handled as a completed flow in which consent was not granted.

### OAuth2.RedirectReqReceived

`Chilkat 11.7.0 · pascal · OAuth2 · RedirectReqReceived · property · read-only · since 9.5.0.92`

```pascal
property RedirectReqReceived: string read GetRedirectReqReceived;
```

Contains the raw HTTP request received from the browser by Chilkat's local redirect listener. It is intended for troubleshooting callback and provider-parameter problems.

```
GET /?state=...&code=... HTTP/1.1
Host: 127.0.0.1:3017
User-Agent: ...
Accept: text/html,...
```

The value can include the request target, query or form parameters, and browser-supplied headers.

**Highly sensitive diagnostic data:** The request can contain an authorization code, state value, provider identifiers, and browser metadata. Do not record it in production logs without careful redaction.

### OAuth2.RefreshToken

`Chilkat 11.7.0 · pascal · OAuth2 · RefreshToken · property · read/write · since 9.5.0.59`

```pascal
property RefreshToken: string read GetRefreshToken write SetRefreshToken;
```

Gets or sets the refresh token used to obtain new access tokens. Chilkat populates this property when the token endpoint issues a `refresh_token`, and `RefreshAccessToken` reads it when creating a refresh request.

A provider may omit the refresh token unless an offline-access scope or provider-specific authorization parameter was requested. A refresh response may also return a replacement token.

**Long-lived credential:** Refresh tokens commonly outlive access tokens and can be used without user interaction. Protect them at least as carefully as passwords, persist replacements after rotation, and delete them when authorization is revoked.

### OAuth2.Resource

`Chilkat 11.7.0 · pascal · OAuth2 · Resource · property · read/write · since 9.5.0.67`

```pascal
property Resource: string read GetResource write SetResource;
```

**Full documentation for this property (same in every language):** [Explaining the OAuth2 Resource Query Parameter](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_resource_query_param.md)

Specifies an optional provider-defined `resource` parameter identifying the API or audience for which a token is requested.

This is used by some OAuth deployments, including older Microsoft identity endpoints and certain Dynamics configurations. Modern Microsoft v2 endpoints generally identify the target API through scope values instead.

**Not a universal OAuth parameter:** Set this property only when the authorization server documents a required `resource` value. Do not assume that an API base URL is always the correct value.

### OAuth2.ResponseMode

`Chilkat 11.7.0 · pascal · OAuth2 · ResponseMode · property · read/write · since 9.5.0.78`

```pascal
property ResponseMode: string read GetResponseMode write SetResponseMode;
```

**Full documentation for this property (same in every language):** [Explaining the OAuth2 Response Mode Query Parameter](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_response_mode_query_param.md)

Specifies the response mode requested from an OpenID Connect or provider-specific authorization endpoint.

Set to `form_post` to add `response_mode=form_post`, causing the authorization server to return parameters in an auto-submitted HTML form that sends an HTTP POST to the redirect URI. The default is an empty string, which omits the parameter and lets the provider choose its normal mode.

**Provider support required:** Use only a response mode supported by the provider and compatible with Chilkat's local listener or intermediary callback.

### OAuth2.ResponseType

`Chilkat 11.7.0 · pascal · OAuth2 · ResponseType · property · read/write · since 9.5.0.78`

```pascal
property ResponseType: string read GetResponseType write SetResponseType;
```

Specifies the authorization response type. The default is `code`, which requests an authorization code.

Set to `id_token+code` when a provider requires the OpenID Connect hybrid response `response_type=id_token code`; the plus sign is the URL-encoded representation of a SPACE in the query string.

**Prefer the code flow unless required otherwise:** Hybrid responses add an ID token to the browser-facing authorization response and require correct OpenID Connect validation, including issuer, audience, signature, expiration, and nonce checks.

### OAuth2.Scope

`Chilkat 11.7.0 · pascal · OAuth2 · Scope · property · read/write · since 9.5.0.59`

```pascal
property Scope: string read GetScope write SetScope;
```

Specifies the access scopes requested from the authorization server. A scope is a provider-defined permission or capability associated with the resulting access token.

OAuth scope values are commonly separated by a single SPACE character:

```
openid email profile https://www.googleapis.com/auth/drive.readonly
```

- `openid` requests OpenID Connect processing and an ID token when used with an appropriate response type.
- `email` and `profile` request standard OpenID Connect claims.
- The Google Drive URI requests read-only access to Drive files.

**Provider-defined and consented:** Scope names, separators, defaults, and offline-access requirements vary by provider. Request the minimum permissions needed and verify the granted scope returned in the token response.

### OAuth2.StateParam

`Chilkat 11.7.0 · pascal · OAuth2 · StateParam · property · read/write · since 9.5.0.94`

```pascal
property StateParam: string read GetStateParam write SetStateParam;
```

Allows the application to supply an explicit OAuth `state` value. Normally this property should remain empty so Chilkat generates a cryptographically random state value and validates the returned value automatically.

The automatically generated state is intentionally not exposed through this property.

The special token `{listenPort}` may appear in an explicitly supplied value. Chilkat replaces it with the actual listener port selected for the flow.

**Do not weaken state:** State correlates the redirect with the initiating browser flow and helps prevent CSRF and authorization-response injection. If supplying your own value, make it unpredictable, unique per flow, and free of secrets or sensitive application data.

### OAuth2.TokenEndpoint

`Chilkat 11.7.0 · pascal · OAuth2 · TokenEndpoint · property · read/write · since 9.5.0.59`

```pascal
property TokenEndpoint: string read GetTokenEndpoint write SetTokenEndpoint;
```

Specifies the provider's token endpoint. Chilkat sends authorization-code and refresh-token requests to this URL over TLS.

| Provider | Authorization endpoint | Token endpoint |
| :--- | :--- | :--- |
| Google | `https://accounts.google.com/o/oauth2/v2/auth` | `https://oauth2.googleapis.com/token` |
| Microsoft identity platform | `https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize` | `https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token` |
| Salesforce production | `https://login.salesforce.com/services/oauth2/authorize` | `https://login.salesforce.com/services/oauth2/token` |
| QuickBooks Online | `https://appcenter.intuit.com/connect/oauth2` | `https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer` |
| X API | `https://x.com/i/oauth2/authorize` | `https://api.x.com/2/oauth2/token` |

**Back-channel endpoint:** Unlike the authorization endpoint, the token endpoint is contacted directly by the application, not opened in the user's browser.

**Use the provider's current HTTPS endpoint:** Endpoint locations can change. Prefer the value published in the provider's OAuth or OpenID Connect metadata, and do not mix sandbox and production endpoints.

### OAuth2.TokenType

`Chilkat 11.7.0 · pascal · OAuth2 · TokenType · property · read/write · since 9.5.0.59`

```pascal
property TokenType: string read GetTokenType write SetTokenType;
```

Contains the `token_type` value from the most recent successful token response. The common value is `Bearer`.

**Use the returned type:** OAuth does not require every token to use the same presentation mechanism. Follow the authorization server's documentation and the returned token type when constructing API requests.

### OAuth2.UncommonOptions

`Chilkat 11.7.0 · pascal · OAuth2 · UncommonOptions · property · read/write · since 9.5.0.85`

```pascal
property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions;
```

Provides a comma-separated list of specialized compatibility options. The default is an empty string and is appropriate for normal OAuth providers.

| Keyword | Effect |
| :--- | :--- |
| `NO_OAUTH2_SCOPE` | Omits the `scope` parameter from the authorization-code token request. |
| `ExchangeCodeForTokenUsingJson` | Sends the authorization-code token request as an HTTP POST with a JSON body instead of the normal form/query representation. |
| `RefreshTokenUsingJson` | Sends the refresh-token request as an HTTP POST with a JSON body. |

**Leave empty unless required:** These options alter interoperability behavior outside the normal OAuth token-request format. Enable one only when the provider's documentation or Chilkat support explicitly requires it.

### OAuth2.UseBasicAuth

`Chilkat 11.7.0 · pascal · OAuth2 · UseBasicAuth · property · read/write · since 9.5.0.73`

```pascal
property UseBasicAuth: Boolean read GetUseBasicAuth write SetUseBasicAuth;
```

Controls how `ClientId` and `ClientSecret` are supplied during the authorization-code token exchange.

| Value | Behavior |
| :--- | :--- |
| `True` | Sends HTTP Basic authentication using the client ID as the username and the client secret as the password. |
| `False` | Sends the client ID and client secret as request parameters. This is the default. |

**Match the provider's client-authentication method:** Some authorization servers require HTTP Basic authentication; others require parameters or no client secret for public clients. A wrong choice usually produces an `invalid_client` response.

**TLS is mandatory:** Both forms expose the secret to the token endpoint. They differ in HTTP representation, not in the need for a secure TLS connection.

## Methods

### OAuth2.AddAuthQueryParam

`Chilkat 11.7.0 · pascal · OAuth2 · AddAuthQueryParam · method · since 9.5.0.85`

```pascal
function  AddAuthQueryParam(const name: string;
    const value: string): Boolean;
```

Adds a name/value query parameter to the authorization URL produced by `StartAuth`. Call the method multiple times to add multiple provider-specific authorization parameters.

Typical examples include provider extensions such as `access_type=offline`, `prompt=consent`, or an account-selection hint.

**Do not add secrets:** Authorization parameters are placed in a URL and can appear in browser history, proxy logs, and diagnostics. Never put a client secret, access token, refresh token, or other credential in an authorization query parameter.

Returns True for success, False for failure.

### OAuth2.AddRefreshQueryParam

`Chilkat 11.7.0 · pascal · OAuth2 · AddRefreshQueryParam · method · since 9.5.0.97`

```pascal
function  AddRefreshQueryParam(const name: string;
    const value: string): Boolean;
```

Adds a provider-specific name/value parameter to requests sent by `RefreshAccessToken`. Call the method multiple times to add multiple parameters.

**Use only when documented:** Chilkat automatically supplies the standard refresh-token grant parameters. Additional parameters are provider extensions and should be added only when required by the authorization server.

Returns True for success, False for failure.

### OAuth2.AddTokenQueryParam

`Chilkat 11.7.0 · pascal · OAuth2 · AddTokenQueryParam · method · since 9.5.0.85`

```pascal
function  AddTokenQueryParam(const name: string;
    const value: string): Boolean;
```

Adds a provider-specific name/value parameter to the authorization-code token request that Chilkat sends after receiving the browser redirect. Call the method multiple times to add multiple parameters.

This setting affects the code-for-token exchange performed by `StartAuth` or `ExchangeCodeForToken`; it does not alter the browser authorization URL or refresh-token requests.

**Nonstandard extension:** The normal authorization-code request parameters are generated automatically. Use this method only for an additional parameter documented by the provider, and do not duplicate standard parameters such as `grant_type`, `code`, or `redirect_uri` unless instructed by Chilkat support.

Returns True for success, False for failure.

### OAuth2.Cancel

`Chilkat 11.7.0 · pascal · OAuth2 · Cancel · method · since 9.5.0.59`

```pascal
function  Cancel: Boolean;
```

Requests cancellation of the authorization flow currently running in the background thread.

Returns `True` if the cancellation request is accepted. After cancellation, inspect `AuthFlowState` and `FailureInfo` to determine the final state.

**Scope of cancellation:** This stops the local authorization operation. It does not revoke an access token, refresh token, authorization grant, or consent that the provider has already issued.

Returns True for success, False for failure.

### OAuth2.ExchangeCodeForToken

`Chilkat 11.7.0 · pascal · OAuth2 · ExchangeCodeForToken · method · since 10.0.2`

```pascal
function  ExchangeCodeForToken(const code: string): Boolean;
```

**Full documentation for this method (same in every language):** [More About the OAuth2 OOB (Out-of-Band) Flow](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_oob_flow.md)

Exchanges the authorization code in `code` for tokens at `TokenEndpoint`.

This is used when the application obtains the authorization code outside Chilkat's local-listener workflow, most commonly with the legacy out-of-band mode selected by `Oob`. Configure the same client, endpoint, redirect, PKCE, and token-request settings that the provider requires for the original authorization request.

On success, the token properties and `AccessTokenResponse` are populated in the same manner as a successful background exchange.

**Legacy OOB flow:** Many major providers no longer accept `urn:ietf:wg:oauth:2.0:oob`. Prefer an authorization-code flow with a loopback redirect and PKCE whenever the provider supports it.

Returns True for success, False for failure.

### OAuth2.GetAccessTokenResponseSb

`Chilkat 11.7.0 · pascal · OAuth2 · GetAccessTokenResponseSb · method · since 10.1.0`

```pascal
// sb is a TStringBuilder object.

function  GetAccessTokenResponseSb(sb: TChilkatBase): Boolean;
```

Copies the raw token-endpoint response into `sb` and returns `True` on success.

This is the `StringBuilder` equivalent of reading `AccessTokenResponse`. The response is commonly JSON, but some providers return form-encoded or other text; this method does not guarantee JSON.

**Contains credentials:** The response can contain an access token and refresh token. Treat the destination `StringBuilder` as sensitive data and avoid logging or exposing its contents.

Returns True for success, False for failure.

### OAuth2.GetRedirectRequestParam

`Chilkat 11.7.0 · pascal · OAuth2 · GetRedirectRequestParam · method · since 9.5.0.69`

```pascal
function  GetRedirectRequestParam(const paramName: string): string;
```

Returns the decoded value of `paramName` from the authorization redirect received by Chilkat's local listener.

Call this after the redirect has been received. It is useful for provider-specific parameters in addition to the standard `code`, `state`, and `error` values. For example, QuickBooks can return a company identifier named `realmId`:

```
http://localhost:55568/?state=...&code=...&realmId=1234567890
```

**Provider extensions:** OAuth defines the core redirect parameters, but providers may add their own values. Consult the provider's documentation before depending on an additional parameter.

**Sensitive redirect data:** Authorization codes and related callback parameters are credentials or security-sensitive correlation values. Avoid writing them to ordinary application logs.

Returns True for success, False for failure.

### OAuth2.LaunchBrowser

`Chilkat 11.7.0 · pascal · OAuth2 · LaunchBrowser · method · since 10.1.2`

```pascal
function  LaunchBrowser(const url: string): Boolean;
```

Asks the operating system to open `url` in the user's default web browser. On Windows, macOS, and supported Linux desktop environments, an existing browser may open the URL in a new tab.

This method is typically called with the authorization URL returned by `StartAuth`. Returns `False` if the operating system cannot launch a browser or open the URL.

**No browser automation:** This method only opens the URL. Chilkat does not control the browser, enter credentials, approve consent, or close the browser window.

Returns True for success, False for failure.

### OAuth2.LoadTaskCaller

`Chilkat 11.7.0 · pascal · OAuth2 · LoadTaskCaller · method · since 9.5.0.80`

```pascal
// task is a TTask object.

function  LoadTaskCaller(task: TChilkatBase): Boolean;
```

Loads state from `task` so this object can act as the caller associated with a Chilkat asynchronous task.

Returns True for success, False for failure.

### OAuth2.RefreshAccessToken

`Chilkat 11.7.0 · pascal · OAuth2 · RefreshAccessToken · method · since 9.5.0.59`

```pascal
function  RefreshAccessToken: Boolean;
```

Sends a refresh-token grant request to `TokenEndpoint` to obtain a new access token without repeating interactive browser authorization.

Configure `ClientId`, `RefreshToken`, and `TokenEndpoint`, together with whatever client authentication the provider requires. This may include `ClientSecret` and `UseBasicAuth`.

On success, Chilkat updates `AccessToken`, `TokenType`, and `AccessTokenResponse`. If the provider rotates refresh tokens and returns a new `refresh_token`, `RefreshToken` is also updated.

**Persist rotated refresh tokens:** Some providers invalidate the old refresh token as soon as a new one is issued. After a successful refresh, securely persist the current value of `RefreshToken` rather than assuming the previous value remains usable.

**Provider-specific requests:** Use `SetRefreshHeader` and `AddRefreshQueryParam` only when the provider documents additional headers or parameters.

Returns True for success, False for failure.

### OAuth2.SetRefreshHeader

`Chilkat 11.7.0 · pascal · OAuth2 · SetRefreshHeader · method · since 9.5.0.77`

```pascal
function  SetRefreshHeader(const name: string;
    const value: string): Boolean;
```

**Full documentation for this method (same in every language):** [Explaining the OAuth2 Refresh Token Request](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_refresh_token_request.md)

Adds or replaces an HTTP request header used by subsequent calls to `RefreshAccessToken`. `name` is the header field name and `value` is its value.

Call this method once for each required header. Passing an empty `value` removes the named header.

```
Accept: application/json
```

**Normally unnecessary:** Standard OAuth refresh requests do not require application-defined headers beyond those generated by the client. Add headers only when the authorization server explicitly requires them, and never place access tokens, refresh tokens, or client secrets in diagnostic headers.

Returns True for success, False for failure.

### OAuth2.SleepMs

`Chilkat 11.7.0 · pascal · OAuth2 · SleepMs · method · since 9.5.0.59`

```pascal
procedure SleepMs(millisec: Integer);
```

Suspends the calling thread for `millisec` milliseconds.

This convenience method is commonly used in a polling loop that checks `AuthFlowState` while the authorization flow continues on Chilkat's background thread.

**Thread behavior:** The calling thread is blocked for the requested interval. In a graphical application, use the platform's normal asynchronous or timer mechanism when blocking the UI thread would make the application unresponsive.

### OAuth2.StartAuth

`Chilkat 11.7.0 · pascal · OAuth2 · StartAuth · method · since 9.5.0.59`

```pascal
function  StartAuth: string;
```

**Full documentation for this method (same in every language):** [Explaining the OAuth2 Authorization Code Flow](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_authorization_flow.md) · [OAuth2 Require Proof Key for Code Exchange (PKCE) Explained](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/oauth2_pkce.md)

Starts an OAuth 2.0 Authorization Code flow and returns the authorization URL that the application should open in the user's browser.

Before calling this method, configure `ClientId`, `AuthorizationEndpoint`, `TokenEndpoint`, the requested `Scope`, and the redirect-listener settings such as `ListenPort`. Configure `ClientSecret` only when the provider requires client authentication for this application type.

1. Chilkat constructs and returns the provider's authorization URL.
2. Chilkat starts a background thread that listens for the redirect request, validates the returned state, and exchanges the authorization code at the token endpoint.

Open the returned URL with `LaunchBrowser` or another browser-launch mechanism. Poll `AuthFlowState` until the flow reaches a terminal state.

**PKCE and client authentication:** Enabling `CodeChallenge` protects the authorization code from interception and is strongly recommended for desktop and other native applications. PKCE does not make a client secret confidential and does not replace client authentication when the provider requires it for a confidential client.

**Failure detection:** String-returning bindings return an empty or null-equivalent value on failure. Check the normal method-success indicator and inspect `LastErrorText` before attempting to open the returned URL.

Returns True for success, False for failure.

### OAuth2.UseConnection

`Chilkat 11.7.0 · pascal · OAuth2 · UseConnection · method · since 9.5.0.59`

```pascal
// sock is a TSocket object.

function  UseConnection(sock: TChilkatBase): Boolean;
```

Associates `sock` with this object for HTTP connections to the token endpoint. This method is optional.

- Pass an unconnected `Socket` when it is configured with HTTP-proxy, SOCKS-proxy, local-bind, or other connection options that Chilkat should use when opening the token-endpoint connection.
- Pass an already connected socket when traffic must travel through an established SSH tunnel or another prebuilt connection.

Without this method, Chilkat opens a direct TLS connection to the token endpoint.

**Browser traffic is separate:** This socket controls Chilkat's back-channel token requests. It does not configure the user's browser, the provider's authorization page, or the browser's redirect to the local listener.

Returns True for success, False for failure.

## Events and callbacks

Chilkat for Pascal supports three synchronous event callbacks: `OnAbortCheck`, `OnPercentDone`, and `OnProgressInfo`. Each is a property of the class; assign a method of one of your own objects (an *of object* handler) to receive the callbacks, or assign `nil` to unhook. The handler types are declared in the `Chilkat.Base` unit:

```pascal
TChilkatAbortCheckEvent   = function(Sender: TChilkatBase): Boolean of object;
TChilkatPercentDoneEvent  = function(Sender: TChilkatBase; PctDone: Integer): Boolean of object;
TChilkatProgressInfoEvent = procedure(Sender: TChilkatBase; const Name, Value: string) of object;
```

All Chilkat methods are synchronous, so callbacks are invoked on the thread that called the method -- if the method was called from the main thread, it is safe to access UI elements from the handler. The `HeartbeatMs` property controls the frequency of `OnAbortCheck` callbacks (the default of 0 means no AbortCheck events fire). Returning `True` from an `OnAbortCheck` or `OnPercentDone` handler aborts the running method.

### OAuth2.AbortCheck (event)

`Chilkat 11.7.0 · pascal · OAuth2 · AbortCheck · event`

```pascal
// TChilkatAbortCheckEvent = function(Sender: TChilkatBase): Boolean of object;

property OnAbortCheck: TChilkatAbortCheckEvent;
```

Enables a method call to be aborted by triggering the AbortCheck event at intervals defined by the `HeartbeatMs` property. If HeartbeatMs is set to its default value of 0, no events will occur. For instance, set HeartbeatMs to 200 to trigger 5 AbortCheck events per second.

**Event callback implementation:**

```pascal
// A handler is a method of one of your own classes, e.g. a form:
function TMyObject.OAuth2AbortCheck(Sender: TChilkatBase): Boolean;
begin
  // Called every HeartbeatMs milliseconds while a method is running.
  // Return True to abort the method; return False to continue.
  Result := False;
end;
```

**To add an event handler:**

```pascal
oauth := TOAuth2.Create;
oauth.HeartbeatMs := 250;   // fire OnAbortCheck 4 times per second
oauth.OnAbortCheck := MyObject.OAuth2AbortCheck;
```

### OAuth2.PercentDone (event)

`Chilkat 11.7.0 · pascal · OAuth2 · PercentDone · event`

```pascal
// TChilkatPercentDoneEvent = function(Sender: TChilkatBase; PctDone: Integer): Boolean of object;

property OnPercentDone: TChilkatPercentDoneEvent;
```

This provides the percentage completion for any method involving network communications or time-consuming processing, assuming the progress can be measured as a percentage. This event is triggered only when it's possible and logical to express the operation's progress as a percentage. The `pctDone` argument will range from 1 to 100. For methods that finish quickly, the number of PercentDone callbacks may vary, but the final callback will have `pctDone` equal to 100. For longer operations, callbacks will not exceed one per percentage point (e.g., 1, 2, 3, ..., 98, 99, 100).

The PercentDone callback also acts as an `AbortCheck` event. For fast methods where PercentDone fires, an AbortCheck event may not trigger since the PercentDone callback already provides an opportunity to abort. For longer operations, where time between PercentDone callbacks is extended, AbortCheck callbacks enable more responsive operation termination.

To abort the operation, set the `abort` output argument to `True`. This will cause the method to terminate and return a failure status or corresponding failure value.

**Event callback implementation:**

```pascal
// A handler is a method of one of your own classes, e.g. a form:
function TMyObject.OAuth2PercentDone(Sender: TChilkatBase; PctDone: Integer): Boolean;
begin
  // PctDone ranges from 1 to 100.
  WriteLn('Percent done: ', PctDone);
  // Return True to abort the method; return False to continue.
  Result := False;
end;
```

**To add an event handler:**

```pascal
oauth := TOAuth2.Create;
oauth.OnPercentDone := MyObject.OAuth2PercentDone;
```

### OAuth2.ProgressInfo (event)

`Chilkat 11.7.0 · pascal · OAuth2 · ProgressInfo · event`

```pascal
// TChilkatProgressInfoEvent = procedure(Sender: TChilkatBase; const Name, Value: string) of object;

property OnProgressInfo: TChilkatProgressInfoEvent;
```

This event callback provides `tag name`/value pairs that detail what occurs during a method call. To discover existing tag names, create code to handle the event, emit the pairs, and review them. Most tag names are self-explanatory.

Note: Some Chilkat methods don't fire any ProgressInfo events.

**Event callback implementation:**

```pascal
// A handler is a method of one of your own classes, e.g. a form:
procedure TMyObject.OAuth2ProgressInfo(Sender: TChilkatBase; const Name, Value: string);
begin
  WriteLn(Name, ': ', Value);
end;
```

**To add an event handler:**

```pascal
oauth := TOAuth2.Create;
oauth.OnProgressInfo := MyObject.OAuth2ProgressInfo;
```

## Related classes

[`Socket`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Socket.md), [`StringBuilder`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/StringBuilder.md)