--- product: Chilkat product_version: 11.7.0 language: pascal language_label: Lazarus Pascal class: Secrets license: bundle deprecated: false reference_html: https://www.chilkatsoft.com/refdoc/pascal_SecretsRef.html --- # Chilkat Secrets — Lazarus Pascal — v11.7.0 > Chilkat 11.7.0 · language=pascal · class=Secrets > Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0//classes/Secrets.md`. > Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`. ## Purpose **Manage application secrets through one consistent API.** `Chilkat.Secrets` provides a unified interface for storing, retrieving, listing, and deleting secrets across local, cloud-based, and in-memory secret stores. It supports string, binary, and JSON secrets, making it useful for passwords, API keys, OAuth credentials, tokens, unlock codes, certificates, and private configuration data. **Local secure storage** - Windows Credential Manager - Apple Keychain **Cloud secret managers** - AWS Secrets Manager - Azure Key Vault - IBM Cloud Secrets Manager - Oracle Cloud Secrets - Doppler Secrets **Temporary secrets** Use in-memory secrets when values should exist only for the lifetime of the running process. **Flexible content types** Store and retrieve secrets as strings, binary data, or structured JSON. **Note:** Cloud-based secret managers often require local bootstrap credentials. These can be stored securely in the Windows Credential Manager or Apple Keychain and then used to authenticate to the cloud secret manager. Start with the [Conceptual Overview](https://www.chilkatsoft.com/chilkat_secrets_api.asp) and [Components of a Secret Name](https://www.chilkatsoft.com/components_of_a_secret_name.asp). For an extended overview, see the [Secrets Class Overview](https://www.chilkatsoft.com/secrets_class_overview.asp). ## Object creation, unlocking and error handling **Create / Free** ```pascal uses Chilkat.Secrets; var obj: TSecrets; begin obj := TSecrets.Create; try if not obj.IsValid then raise Exception.Create('Failed to create a TSecrets instance.'); // ... use obj ... finally obj.Free; end; end; ``` `constructor Create;` Allocates the underlying CkSecrets object and returns a new TSecrets instance. Simply adding **Chilkat.Secrets** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed). `destructor Destroy; override;` Every TSecrets created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkSecrets handle. A native (unmanaged) memory leak occurs if the object is never freed. Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal. ## Members common to every Chilkat class Documented once per language in `common-members.md`; listed here so this page is self-contained. | Property | Signature | Access | Meaning | |---|---|---|---| | `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. | | `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. | | `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. | | `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. | | `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. | | `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. | | `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" | ## Member index | Member | Kind | Signature | |---|---|---| | `AutoSplit` | property, read/write | `property AutoSplit: Boolean read GetAutoSplit write SetAutoSplit;` | | `Compression` | property, read/write | `property Compression: Boolean read GetCompression write SetCompression;` | | `Location` | property, read/write | `property Location: string read GetLocation write SetLocation;` | | `UncommonOptions` | property, read/write | `property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions;` | | `DeleteSecret` | method | `// jsonId is a TJsonObject object. function DeleteSecret(jsonId: TChilkatBase): Boolean;` | | `GetSecretBd` | method | `// jsonId is a TJsonObject object. // bd is a TBinData object. function GetSecretBd(jsonId: TChilkatBase;     bd: TChilkatBase): Boolean;` | | `GetSecretJson` | method | `// jsonId is a TJsonObject object. // jsonOut is a TJsonObject object. function GetSecretJson(jsonId: TChilkatBase;     jsonOut: TChilkatBase): Boolean;` | | `GetSecretSb` | method | `// jsonId is a TJsonObject object. // sb is a TStringBuilder object. function GetSecretSb(jsonId: TChilkatBase;     sb: TChilkatBase): Boolean;` | | `GetSecretStr` | method | `// jsonId is a TJsonObject object. function GetSecretStr(jsonId: TChilkatBase): string;` | | `ListSecrets` | method | `// json is a TJsonObject object. // jsonOut is a TJsonObject object. function ListSecrets(json: TChilkatBase;     jsonOut: TChilkatBase): Boolean;` | | `SecretSpecToJson` | method | `// json is a TJsonObject object. function SecretSpecToJson(const secretSpec: string;     json: TChilkatBase): Boolean;` | | `SetBootstrapSecret` | method | `// jsonId is a TJsonObject object. // secretContent is a TSecrets object. function SetBootstrapSecret(jsonId: TChilkatBase;     secretContent: TChilkatBase): Boolean;` | | `UpdateSecretBd` | method | `// jsonId is a TJsonObject object. // secret is a TBinData object. function UpdateSecretBd(jsonId: TChilkatBase;     secret: TChilkatBase): Boolean;` | | `UpdateSecretJson` | method | `// jsonId is a TJsonObject object. // secret is a TJsonObject object. function UpdateSecretJson(jsonId: TChilkatBase;     secret: TChilkatBase): Boolean;` | | `UpdateSecretSb` | method | `// jsonId is a TJsonObject object. // sb is a TStringBuilder object. function UpdateSecretSb(jsonId: TChilkatBase;     sb: TChilkatBase): Boolean;` | | `UpdateSecretStr` | method | `// jsonId is a TJsonObject object. function UpdateSecretStr(jsonId: TChilkatBase;     const secret: string): Boolean;` | ## Properties ### Secrets.AutoSplit `Chilkat 11.7.0 · pascal · Secrets · AutoSplit · property · read/write · since 10.1.0` ```pascal property AutoSplit: Boolean read GetAutoSplit write SetAutoSplit; ``` The AutoSplit property is specific to `local_manager` secrets on Windows. The Windows Credentials Manager supports a maximum of 2560 bytes per secret. If a secret exceeds this size, it will be automatically compressed and split when created or updated, and automatically recomposed when retrieved. A secret can be split into a maximum of 10 parts. The default value is `True`. ### Secrets.Compression `Chilkat 11.7.0 · pascal · Secrets · Compression · property · read/write · since 10.1.0` ```pascal property Compression: Boolean read GetCompression write SetCompression; ``` If set to `True`, then the contents of the secret will be stored compressed. The default value of this property is `False`. ### Secrets.Location `Chilkat 11.7.0 · pascal · Secrets · Location · property · read/write · since 10.1.0` ```pascal property Location: string read GetLocation write SetLocation; ``` The location of the secrets. Possible values are: - `local_manager` - On Windows this is the Credentials Manager. On MacOS and iOS it is the Keychain. This is not yet an option on Linux or Android. - `aws_secrets_manager` - AWS Secrets Manager - `azure_key_vault` - Azure Key Vault - `ibm_cloud` - IBM Cloud Secrets Manager - `oracle_cloud` - Oracle Cloud Secrets - `doppler` - Doppler Secrets - `memory` - In-Memory Secrets The default location is the `local_manager`. On Linux and Android, `local_manager` will behave the same as `memory`. ### Secrets.UncommonOptions `Chilkat 11.7.0 · pascal · Secrets · UncommonOptions · property · read/write · since 10.1.0` ```pascal property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions; ``` This is a catch-all property to be used for uncommon needs. This property defaults to the empty string and should typically remain empty. ## Methods ### Secrets.DeleteSecret `Chilkat 11.7.0 · pascal · Secrets · DeleteSecret · method · since 10.1.0` ```pascal // jsonId is a TJsonObject object. function DeleteSecret(jsonId: TChilkatBase): Boolean; ``` Deletes a secret. Cloud secrets managers will typically disable the secret and schedule the secret for deletion after some number of days. Returns True for success, False for failure. ### Secrets.GetSecretBd `Chilkat 11.7.0 · pascal · Secrets · GetSecretBd · method · since 10.1.0` ```pascal // jsonId is a TJsonObject object. // bd is a TBinData object. function GetSecretBd(jsonId: TChilkatBase;     bd: TChilkatBase): Boolean; ``` Fetches a binary secret and returns the content in `bd`. Returns True for success, False for failure. ### Secrets.GetSecretJson `Chilkat 11.7.0 · pascal · Secrets · GetSecretJson · method · since 10.1.0` ```pascal // jsonId is a TJsonObject object. // jsonOut is a TJsonObject object. function GetSecretJson(jsonId: TChilkatBase;     jsonOut: TChilkatBase): Boolean; ``` Fetches a JSON secret and returns the content in `jsonOut`. Returns True for success, False for failure. ### Secrets.GetSecretSb `Chilkat 11.7.0 · pascal · Secrets · GetSecretSb · method · since 10.1.0` ```pascal // jsonId is a TJsonObject object. // sb is a TStringBuilder object. function GetSecretSb(jsonId: TChilkatBase;     sb: TChilkatBase): Boolean; ``` Fetches a string secret and returns the content in `sb`. Returns True for success, False for failure. ### Secrets.GetSecretStr `Chilkat 11.7.0 · pascal · Secrets · GetSecretStr · method · since 10.1.0` ```pascal // jsonId is a TJsonObject object. function GetSecretStr(jsonId: TChilkatBase): string; ``` Fetches a string secret and returns the content of the secret. Returns True for success, False for failure. ### Secrets.ListSecrets `Chilkat 11.7.0 · pascal · Secrets · ListSecrets · method · since 10.1.0` ```pascal // json is a TJsonObject object. // jsonOut is a TJsonObject object. function ListSecrets(json: TChilkatBase;     jsonOut: TChilkatBase): Boolean; ``` Lists secrets matching the wildcarded or exact values passed in `json`. The results of the query are returned in `jsonOut`. Returns True for success, False for failure. ### Secrets.SecretSpecToJson `Chilkat 11.7.0 · pascal · Secrets · SecretSpecToJson · method · since 11.5.0` ```pascal // json is a TJsonObject object. function SecretSpecToJson(const secretSpec: string;     json: TChilkatBase): Boolean; ``` Converts a secret specification string (`secretSpec`) to JSON. A secret specification string is formatted as "!!part1\|part2\|part3\|part4" where parts 3 and 4 are optional. `json` is the output argument. Returns True for success, False for failure. ### Secrets.SetBootstrapSecret `Chilkat 11.7.0 · pascal · Secrets · SetBootstrapSecret · method · since 10.1.0` ```pascal // jsonId is a TJsonObject object. // secretContent is a TSecrets object. function SetBootstrapSecret(jsonId: TChilkatBase;     secretContent: TChilkatBase): Boolean; ``` Accessing a cloud-based secrets manager requires authentication credentials, which cannot be stored in the manager itself. Instead, they must be securely stored locally. One solution is to store the authentication credentials as a secret in the Windows Credentials Manager or Apple Keychain. These credentials serve as the `bootstrap secret` for authenticating with the cloud-based secrets manager. `jsonId` contains the name of the bootstrap secret. `secretContent` contains the bootstrap's secret content. Returns True for success, False for failure. ### Secrets.UpdateSecretBd `Chilkat 11.7.0 · pascal · Secrets · UpdateSecretBd · method · since 10.1.0` ```pascal // jsonId is a TJsonObject object. // secret is a TBinData object. function UpdateSecretBd(jsonId: TChilkatBase;     secret: TChilkatBase): Boolean; ``` Creates a binary secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in `jsonId`, and the binary content of the secret in `secret`. Returns True for success, False for failure. ### Secrets.UpdateSecretJson `Chilkat 11.7.0 · pascal · Secrets · UpdateSecretJson · method · since 10.1.0` ```pascal // jsonId is a TJsonObject object. // secret is a TJsonObject object. function UpdateSecretJson(jsonId: TChilkatBase;     secret: TChilkatBase): Boolean; ``` Creates a JSON secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in `jsonId`, and the JSON content of the secret in `secret`. Returns True for success, False for failure. ### Secrets.UpdateSecretSb `Chilkat 11.7.0 · pascal · Secrets · UpdateSecretSb · method · since 10.1.0` ```pascal // jsonId is a TJsonObject object. // sb is a TStringBuilder object. function UpdateSecretSb(jsonId: TChilkatBase;     sb: TChilkatBase): Boolean; ``` Creates a string secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in `jsonId`, and the string content of the secret in `sb`. Returns True for success, False for failure. ### Secrets.UpdateSecretStr `Chilkat 11.7.0 · pascal · Secrets · UpdateSecretStr · method · since 10.1.0` ```pascal // jsonId is a TJsonObject object. function UpdateSecretStr(jsonId: TChilkatBase;     const secret: string): Boolean; ``` Creates a string secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in `jsonId`, and the string content of the secret in `secret`. Note: Starting in Chilkat **v11.3.0**, if the `service` = `"Chilkat"` and the `username` = `"unlock_code"`, then the secret (which is the Chilkat unlock code) can be stored and retrieved without Chilkat being unlocked. This allows for the Chilkat unlock code itself to be persisted to a secrets manager. Returns True for success, False for failure. ## Events and callbacks Chilkat for Pascal supports three synchronous event callbacks: `OnAbortCheck`, `OnPercentDone`, and `OnProgressInfo`. Each is a property of the class; assign a method of one of your own objects (an *of object* handler) to receive the callbacks, or assign `nil` to unhook. The handler types are declared in the `Chilkat.Base` unit: ```pascal TChilkatAbortCheckEvent = function(Sender: TChilkatBase): Boolean of object; TChilkatPercentDoneEvent = function(Sender: TChilkatBase; PctDone: Integer): Boolean of object; TChilkatProgressInfoEvent = procedure(Sender: TChilkatBase; const Name, Value: string) of object; ``` All Chilkat methods are synchronous, so callbacks are invoked on the thread that called the method -- if the method was called from the main thread, it is safe to access UI elements from the handler. The `HeartbeatMs` property controls the frequency of `OnAbortCheck` callbacks (the default of 0 means no AbortCheck events fire). Returning `True` from an `OnAbortCheck` or `OnPercentDone` handler aborts the running method. ### Secrets.AbortCheck (event) `Chilkat 11.7.0 · pascal · Secrets · AbortCheck · event` ```pascal // TChilkatAbortCheckEvent = function(Sender: TChilkatBase): Boolean of object; property OnAbortCheck: TChilkatAbortCheckEvent; ``` Enables a method call to be aborted by triggering the AbortCheck event at intervals defined by the `HeartbeatMs` property. If HeartbeatMs is set to its default value of 0, no events will occur. For instance, set HeartbeatMs to 200 to trigger 5 AbortCheck events per second. **Event callback implementation:** ```pascal // A handler is a method of one of your own classes, e.g. a form: function TMyObject.SecretsAbortCheck(Sender: TChilkatBase): Boolean; begin // Called every HeartbeatMs milliseconds while a method is running. // Return True to abort the method; return False to continue. Result := False; end; ``` **To add an event handler:** ```pascal secrets := TSecrets.Create; secrets.HeartbeatMs := 250; // fire OnAbortCheck 4 times per second secrets.OnAbortCheck := MyObject.SecretsAbortCheck; ``` ### Secrets.PercentDone (event) `Chilkat 11.7.0 · pascal · Secrets · PercentDone · event` ```pascal // TChilkatPercentDoneEvent = function(Sender: TChilkatBase; PctDone: Integer): Boolean of object; property OnPercentDone: TChilkatPercentDoneEvent; ``` This provides the percentage completion for any method involving network communications or time-consuming processing, assuming the progress can be measured as a percentage. This event is triggered only when it's possible and logical to express the operation's progress as a percentage. The `pctDone` argument will range from 1 to 100. For methods that finish quickly, the number of PercentDone callbacks may vary, but the final callback will have `pctDone` equal to 100. For longer operations, callbacks will not exceed one per percentage point (e.g., 1, 2, 3, ..., 98, 99, 100). The PercentDone callback also acts as an `AbortCheck` event. For fast methods where PercentDone fires, an AbortCheck event may not trigger since the PercentDone callback already provides an opportunity to abort. For longer operations, where time between PercentDone callbacks is extended, AbortCheck callbacks enable more responsive operation termination. To abort the operation, set the `abort` output argument to `True`. This will cause the method to terminate and return a failure status or corresponding failure value. **Event callback implementation:** ```pascal // A handler is a method of one of your own classes, e.g. a form: function TMyObject.SecretsPercentDone(Sender: TChilkatBase; PctDone: Integer): Boolean; begin // PctDone ranges from 1 to 100. WriteLn('Percent done: ', PctDone); // Return True to abort the method; return False to continue. Result := False; end; ``` **To add an event handler:** ```pascal secrets := TSecrets.Create; secrets.OnPercentDone := MyObject.SecretsPercentDone; ``` ### Secrets.ProgressInfo (event) `Chilkat 11.7.0 · pascal · Secrets · ProgressInfo · event` ```pascal // TChilkatProgressInfoEvent = procedure(Sender: TChilkatBase; const Name, Value: string) of object; property OnProgressInfo: TChilkatProgressInfoEvent; ``` This event callback provides `tag name`/value pairs that detail what occurs during a method call. To discover existing tag names, create code to handle the event, emit the pairs, and review them. Most tag names are self-explanatory. Note: Some Chilkat methods don't fire any ProgressInfo events. **Event callback implementation:** ```pascal // A handler is a method of one of your own classes, e.g. a form: procedure TMyObject.SecretsProgressInfo(Sender: TChilkatBase; const Name, Value: string); begin WriteLn(Name, ': ', Value); end; ``` **To add an event handler:** ```pascal secrets := TSecrets.Create; secrets.OnProgressInfo := MyObject.SecretsProgressInfo; ``` ## Related classes [`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/BinData.md), [`JsonObject`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/JsonObject.md), [`StringBuilder`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/StringBuilder.md)