ClearAuthentication

procedure ClearAuthentication;

Example

procedure ScriptEvent(var Value: variant);
begin
  Http.ClearAuthentication;
  Http.Username := 'service-account';
  Http.Password := 'replacement-secret';
  Value := 'Authentication state will be rebuilt on the next request';
end;

Usage

ClearAuthentication marks the HTTP client unauthenticated and destroys its current Velox authentication object without erasing configured credentials or authentication mode.

Additional Technical Info

ClearAuthentication sets the client's internal authenticated flag to false and frees FHTTP.Request.Authentication when one exists. It performs no network operation.

The method does not clear AuthType, Username, Password, Domain, OAuth client/secret/token settings, request Username/Password, cookies, headers or an OAuth authenticator/access-token cache. On the next request, authentication configuration can immediately create another Indy authentication object from those retained fields.

Use it when credential or scheme settings have changed and the next call must rebuild the per-request authentication state. To remove authentication, also set AuthType := fatNone and clear sensitive configuration fields that should no longer remain in memory.

Calling the method repeatedly is safe with respect to the authentication object. It is not synchronised; never call it while the same TvxHTTP instance is executing a request in another thread.

The standard Http object remains host/scripter-owned. Clearing its authentication state does not transfer ownership and is not equivalent to freeing the client.

External references

• RFC 9110 section 11: HTTP Authentication

Created 2026-07-15