Skip to main content

fatMicrosoftOAuth

fatMicrosoftOAuth = 3

Example​

procedure ConfigureMicrosoftOAuth(Client: TvxHTTP; const Tenant: String);
begin
  Client.AuthType := fatMicrosoftOAuth;
  Client.Tenant := Tenant;
  Client.GrantType := gtClientCredentials;
end;

Usage​

fatMicrosoftOAuth selects Microsoft OAuth with tenant-formatted v2 endpoints, XOAUTH2 for mail and surface-specific default scopes.

Additional Technical Info​

fatMicrosoftOAuth is ordinal 3 of TvxAuthType. It selects Microsoft provider defaults and XOAUTH2 for supported mail surfaces.

SettingCurrent source-defined default
Authorization endpointhttps://login.microsoftonline.com/%s/oauth2/v2.0/authorize
Token endpointhttps://login.microsoftonline.com/%s/oauth2/v2.0/token
Logout endpointhttps://login.microsoftonline.net/%s/oauth2/v2.0/logout
SMTP/IMAP/POP scopehttps://outlook.office365.com/.default
HTTP scopehttps://graph.microsoft.com/.default
gtAuto provider grantgtClientCredentials
Mail SASL mechanismXOAUTH2

Velox substitutes Tenant into every %s endpoint. A blank or wrong tenant therefore produces a malformed/wrong authority URL rather than a configuration-time error. Nonblank AuthURL, TokenURL and Scope override the preset. POP also disables SASL initial response for this member as a source-level Microsoft interoperability workaround.

Configuration and security boundaries​

  • Client-credentials tokens represent an application, not an interactive user. Ensure the target API/mail protocol and tenant permissions support application access.
  • The .default scopes request statically configured application permissions. They do not grant permission by themselves; administrator consent and service-side policy remain external prerequisites.
  • For delegated access, explicitly select the required grant, callback and delegated scopes. Do not rely on the gtAuto default.
  • ClientId, Secret/Password, Tenant, tokens and certificate material are sensitive. Avoid logging them and rotate them under the tenant's policy.
  • Authentication does not configure TLS, validate the target resource URL or verify that a returned token's audience matches the eventual request.

The constant only selects configuration. Token acquisition occurs on authentication and can be retried/refreshed according to the authenticator state. The example was source-reviewed; no tenant, mail, Graph, network or image-function test was executed.

Related Code Library entries

External references

Created 2026-07-15