Introduction to user authentication

User authentication is a set of authentication workflows that allow users with an ArcGIS accountAn ArcGIS account is an identity with a user type and set of privileges that can access specific ArcGIS products, tools, APIs, services, and resources. The main account types that can be used for development are an ArcGIS Location Platform account, ArcGIS Online account, and ArcGIS Enterprise account. ArcGIS Location Platform and ArcGIS Online accounts are also associated with a subscription.Learn more to sign into an application and access ArcGIS contentContent is a collection of items in a portal that belong to a user, group, or organization.Learn more, servicesA service, also known as an ArcGIS service, is software that supports an ArcGIS REST API and provides geospatial functionality or data. A service can be hosted by Esri or in ArcGIS Enterprise.Learn more, and resources. The typical authentication protocol used is OAuth 2.0. When a user signs into an application with their ArcGIS account, an access tokenAn access token is an authorization string that provides access to secure ArcGIS content, data, and services. Its capabilities are determined by the privileges it supports. It is obtained by implementing API key authentication, User authentication, or App authentication.Learn more is generated that authorizes the application to access services and content on their behalf. The resources and functionality available depend on the user type, roles, and privileges of the user's ArcGIS account. This authentication type was previously known as Named user login and ArcGIS identity.

User authentication provides access to secure ArcGIS services and content on behalf of a user. It offers several advantages over other types of authentication:

• Supports the secure OAuth 2.0 authorization_code flow.
• Grants access to all services available to a user, including portal servicesArcGIS portal, also known as a portal, is a website with applications and tools that can be used to create, manage, access, and share geospatial content and data. It supports security and authentication, developer credentials, content and data service management, user and group management, and site administration. A portal can be hosted in Esri's infrastructure or your own infrastructure.Learn more and spatial analysis servicesA spatial analysis service, also known as a feature analysis service, is a service used to perform spatial analysis operations on feature data such as finding, comparing, summarizing, analyzing patterns, and calculating geometries.Learn more.
• Bills usage to user's accounts, rather than the developer's account.

How user authentication works

The typical steps to implement user authentication are as follows:

1. Create a set of OAuth credentialsOAuth credentials are an item that contains parameters required to implement user authentication or app authentication, including a client_id, client_secret, and redirect URIs. They are a type of developer credential.Learn more in your portalArcGIS portal, also known as a portal, is a website with applications and tools that can be used to create, manage, access, and share geospatial content and data. It supports security and authentication, developer credentials, content and data service management, user and group management, and site administration. A portal can be hosted in Esri's infrastructure or your own infrastructure.Learn more and set a redirect URL.

2. Paste the client_id and redirect URL from your OAuth credentials into your application.

3. Use an ArcGIS Maps SDKArcGIS Maps SDKs are developer products for building mapping and spatial analysis applications for web browsers, native devices, and game engines.Learn more or APIAn ArcGIS API is a web, native, game engine, or scripting API that has advanced mapping and spatial analysis capabilities and can be used to access ArcGIS services. ArcGIS APIs are designed to work optimally with the ArcGIS system and provide the most advanced GIS features and the highest performance possible.Learn more to create an authentication manager class and prompt users to sign in.

4. Once authenticated, access the secure resourcesA secure resource is any item or service in an ArcGIS that requires an ArcGIS account and authentication to access. Examples include ArcGIS Location Services, and items and data services in an ArcGIS portal.Learn more available to the signed-in user in your application.

OAuth credentials

OAuth credentials are an itemAn item, also known as a content item, is a resource stored in a portal such as a web map, hosted layer, style, script tool, file, or notebook.Learn more used to support multiple types of authentication. They are required to implement user authenticationUser authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth2.0.Learn more. The most common pattern is to create a new OAuth credentials item for each application. OAuth credentials are used to obtain a client IDA Client ID is an identifier associated with an application that assists with client / server OAuth 2.0 authentication for ArcGIS client APIs.Learn more for your app and authorize its redirect URLs.

User authentication flows

There are six different workflows that can be used to implement user authentication:

• Authorization code flow with PKCE
• Authorization code flow
• Implicit flow
• Manual token generation
• HTTP/Windows/Integrated Windows Authentication
• Public key infrastructure (PKI) authentication

The flow you use will vary based on the type of application you build and client API you select.

Examples

Product and account requirements

User authentication is available with ArcGIS Location PlatformArcGIS Location Platform, formerly known as ArcGIS Platform, is a Platform as a Service (PaaS) product that gives developers access to location services, APIs, and tools to build mapping and spatial analysis applications. It is subscription-based and requires an ArcGIS Location Platform account.Learn more, ArcGIS OnlineArcGIS Online is a GIS mapping, analytics, data hosting, and content management software as a service (SaaS) product. It includes applications, tools, APIs, and location services for users and developers. It is subscription-based and requires an ArcGIS Online account.Learn more, and ArcGIS EnterpriseArcGIS Enterprise is a GIS mapping, analytics, data hosting, and content management product that can be hosted on-premise or in a cloud infrastructure. It includes software, applications, tools, APIs, and services for users and developers.Learn more. If you have ArcGIS Online or ArcGIS Enterprise, your account must have a user type of Creator or higher.

Tutorials

Service support

The following table provides an overview of the functionality available with each type of authentication:

API support