App authentication is a type of authentication that generates short-lived access tokensclient_id, client_secret, and redirect URIs. They are a type of developer credential.
App authentication is typically implemented on a web server or in standalone console scripts. This is to avoid exposing the confidential client and client values contained within OAuth credentials. App authentication is not recommended for client applications without a web server, or in sign-in apps that require authentication with an ArcGIS account.
You can use app authentication to:
- Create web servers and automation scripts that access the portal service
A portal service provides the functionality to securely create, access, and manage content, data services, users, and groups in a portal. The service can be hosted by Esri or in ArcGIS Enterprise. and spatial analysis servicesSpatial analysis services are services that perform geometry and statistical analyses on feature and raster data. . - Create public applications
A public application is an application that allows anonymous access without requiring users to sign in with an ArcGIS account. It supports API key or app authentication. that do not require users to sign in. - Build applications that access location services
ArcGIS Location Services, also referred to as Location Services, are services hosted by Esri that provide geospatial functionality for developing mapping applications. They include the ArcGIS Basemap Styles service, ArcGIS Static Basemap Tiles service, ArcGIS Places service, ArcGIS Geocoding service, ArcGIS Routing service, ArcGIS GeoEnrichment service, and ArcGIS Elevation service. An ArcGIS Location Platform or ArcGIS Online account is required to use the services. and items such as hosted layersA hosted layer is an item in a portal that contains the properties and settings for a hosted data service or a layer in a hosted data service. and data servicesData services, also known as hosted data services, are services created dynamically to store and provide access to your data in ArcGIS. Examples are feature services, vector tile services, map tile services, image services, and scene services. . - Authenticate with an OAuth 2.0
OAuth 2.0 is an industry standard protocol for authorization. It defines how to obtain and manage credentials for web, desktop, and mobile applications. It is supported by ArcGIS. process that provides better security than API key authenticationAPI key authentication is a type of authentication that uses an API key to authenticate requests to ArcGIS services and secure portal items. . - Access secure resources with the privileges of your ArcGIS account
An ArcGIS account is an identity with a user type and set of privileges that can access specific ArcGIS products, tools, APIs, services, and resources. The main account types that can be used for development are an ArcGIS Location Platform account, ArcGIS Online account, and ArcGIS Enterprise account. ArcGIS Location Platform and ArcGIS Online accounts are also associated with a subscription. .
How app authentication works
Apps that implement app authenticationclient and client. These values are generated from OAuth credentialsclient_id, client_secret, and redirect URIs. They are a type of developer credential.
The high-level process of app authentication is as follows:
- Include a
clientand_id clientfrom OAuth credentials_secret OAuth credentials are an item that contains parameters required to implement user authentication or app authentication, including a in your server script.client_id,client_secret, and redirect URIs. They are a type of developer credential. - Create an endpoint for clients to request access tokens.
- When a client requests a token, submit a request to the token endpoint
An token endpoint is an endpoint of a portal service that can be queried to request an access token. It is used to implement user authentication OAuth2.0 flows. of your portal serviceA portal service provides the functionality to securely create, access, and manage content, data services, users, and groups in a portal. The service can be hosted by Esri or in ArcGIS Enterprise. . - Deliver the resulting access token to the client.
- The client uses the access token to access secure resources
A secure resource is any item or service in an ArcGIS that requires an ArcGIS account and authentication to access. Examples include ArcGIS Location Services, and items and data services in an ArcGIS portal. .
OAuth credentials
OAuth credentials are an item
Product and account requirements
App authentication is available with ArcGIS Location Platform
ArcGIS Location Platform
All ArcGIS Location Platform accounts have the correct privileges to manage app authentication by default.
ArcGIS Online
App authentication requires an ArcGIS Online account with a user type of Creator or higher. The account must also have this additional privilege
- General privileges > Content > Assign privileges to OAuth 2.0 applications
Your organization administrator can grant you this privilege using a custom role. Learn more in the FAQ.
ArcGIS Online Trial: App authentication is not available in ArcGIS Online Trial subscriptions, as these accounts cannot assign privileges to OAuth 2.0 credentials.
ArcGIS for Personal Use: App authentication is not available in ArcGIS Online subscriptions purchased through ArcGIS for Personal Use, as these accounts cannot assign privileges to OAuth 2.0 credentials.
ArcGIS Hub: App authentication is not available with for accounts with the Hub Community Member user type. This includes community administrators.
ArcGIS Enterprise
App authentication requires an ArcGIS Enterprise account with a user type of Creator or higher. The account must also have this additional privilege
- General privileges > Content > Assign privileges to OAuth 2.0 applications
Your organization administrator can grant you this privilege using a custom role. Learn more in the FAQ.
Supported versions: The steps in this chapter apply to the latest version of ArcGIS Enterprise (12.0). To view steps for previous versions of Enterprise, go to Developer credentials for ArcGIS Enterprise.
Limitations
Location services
ArcGIS Enterprise limitations: App authentication cannot be used to access ArcGIS Location Services
OAuth 2.0 credentials
Creating credentials: There is no limit to the number of OAuth 2.0 credentials you can create.
Accessing items: An OAuth 2.0 credential can be configured to access a maximum of 100 items
Tutorials
Create OAuth credentials for app authentication
Service support
The following table provides an overview of the functionality available with each type of authentication:
| API key authentication | User authentication | App authentication | |
|---|---|---|---|
| ArcGIS Location Services | 1 | 1 | 1 |
| Data services (Item access) | 2 | ||
| Spatial analysis services | 1 | 1 | |
| Portal service (General privileges) | |||
| Portal service (Admin privileges) |
- 1. Supported with ArcGIS Online and ArcGIS Location Platform.
- 2. Supported, but not recommended due to security risks.