OAuth credentials (for user authentication)

OAuth credentials are an itemAn item, also known as a content item, is a resource stored in a portal such as a web map, hosted layer, style, script tool, file, or notebook.Learn more used to support authentication workflows. They are required to implement user authenticationUser authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth2.0.Learn more and app authenticationApp authentication is a type of authentication that grants a short-lived access token based on an OAuth 2.0 client ID and client secret, authorizing an application to access ArcGIS services and items.Learn more using OAuth 2.0OAuth 2.0 is an industry standard protocol for authorization. It defines how to obtain and manage credentials for web, desktop, and mobile applications. It is supported by ArcGIS.Learn more workflows.

Creating OAuth 2.0 credentials

Prerequisites

All ArcGIS Location Platform accounts have the correct privileges to create OAuth 2.0 credentials by default.

Steps

The steps to create OAuth 2.0 credentials are explained in the Create OAuth credentials for user authentication tutorial:

Most user authenticationUser authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth2.0.Learn more flows require a valid client_id from a set of OAuth credentials. They also require a redirect URL to be configured in the settings of the OAuth credential.

Redirect URLs

A redirect URL is a required parameter of user authenticationUser authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth2.0.Learn more flows. This is the URL that your application will direct users to after they successfully authenticate.

Redirect URLs are managed as a property of OAuth credentialsOAuth credentials are an item that contains parameters required to implement user authentication or app authentication, including a client_id, client_secret, and redirect URIs. They are a type of developer credential.Learn more. They can be added to your credentials during the creation process, or any time through the Settings panel of the credentials item pageAn item page is a web page in ArcGIS Online or the developer dashboard used to access and manage the properties for an item and the content it references such as a web map, hosted layer, or file.Learn more.

To add a redirect URL to your developer credentials, complete the following steps:

1. Sign in to your portalArcGIS portal, also known as a portal, is a website with applications and tools that can be used to create, manage, access, and share geospatial content and data. It supports security and authentication, developer credentials, content and data service management, user and group management, and site administration. A portal can be hosted in Esri's infrastructure or your own infrastructure.Learn more and search for your developer credentialsDeveloper credentials are a type of item in a portal that contains parameters for authentication. There are two types of developer credentials: API key credentials and OAuth credentials.Learn more.

2. Go to the item pageAn item page is a web page in ArcGIS Online or the developer dashboard used to access and manage the properties for an item and the content it references such as a web map, hosted layer, or file.Learn more of the credentials and click Settings > Application.

3. Under Redirect URLs, add the URL that you want to direct users to after completing authentication. This URL varies based on your application and typically takes the format of "https://<server>[:port]/callback.html" or "http://my-arcgis-app:/auth". This is a valid web page or server endpoint to which a user can be redirected after successful sign in.

   • For example, if you are running an application on https://localhost:8080, add https://localhost:8080/callback.html to the list of redirect URLs. The exact URL depends on the name of your callback page and the programming language you are using. If you are following a "Sign in with user authentication" ArcGIS tutorial, it will specify the name of your callback page.
   

Privileges and item access

When implementing user authenticationUser authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth2.0.Learn more, your application inherits all privilegesPrivileges are a set of permissions assigned to ArcGIS accounts, developer credentials, and applications that grant access to secure resources and functionality in ArcGIS.Learn more and item access rights from the signed-in ArcGIS userAn ArcGIS user is a user who has an ArcGIS account and uses it to access an ArcGIS application, custom ArcGIS application, or a resource in an ArcGIS portal.Learn more. Although OAuth credentialsOAuth credentials are an item that contains parameters required to implement user authentication or app authentication, including a client_id, client_secret, and redirect URIs. They are a type of developer credential.Learn more provide settings to manage privileges and item access, these settings are not used in user authentication. To learn how OAuth credentials manage privileges and item access for other types of authentication, go to OAuth credentials (for app authentication)

Referrers

A referrer is an HTTP header field used to identify the client requesting a server resource. This functions as a security measure, allowing applications to confirm their client's identity. When OAuth credentialsOAuth credentials are an item that contains parameters required to implement user authentication or app authentication, including a client_id, client_secret, and redirect URIs. They are a type of developer credential.Learn more have a specific HTTP referer header set, services can confirm that an incoming request's referrer matches one of the valid referrers assigned to that access token.

Specific domains can be provided or you can use wildcard characters (*) in the subdomain of your allowed referrer. For example https://*.your-app.com will allow the access token to be used on both https://dev.your-app.com and https://your-app.com. While it is also possible to restrict access token use to specific paths (https://your-app.com/page), we do not recommend this method because browsers may remove the path due to privacy concerns.

Usage tracking

All services and content accessed with OAuth credentialsOAuth credentials are an item that contains parameters required to implement user authentication or app authentication, including a client_id, client_secret, and redirect URIs. They are a type of developer credential.Learn more are tracked. You can monitor the usage of credentials in order to view the consumption of services and the billing amount.

ArcGIS Location Platform developers use their dashboardA dashboard is configurable web application created with ArcGIS Dashboards that presents location-based analytics through interactive data visualizations on a single screen.Learn more to monitor service usage. To monitor service usage of OAuth credentialsOAuth credentials are an item that contains parameters required to implement user authentication or app authentication, including a client_id, client_secret, and redirect URIs. They are a type of developer credential.Learn more, use the following steps:

1. Go to location.arcgis.com and sign in with an ArcGIS Location Platform accountAn ArcGIS Location Platform account, formerly known as an ArcGIS Developer account, is an identity associated with an ArcGIS Location Platform subscription.Learn more.

2. Click My dashboard > Usage > Developer credentials.

3. In the left sidebar, select the OAuth credentialsOAuth credentials are an item that contains parameters required to implement user authentication or app authentication, including a client_id, client_secret, and redirect URIs. They are a type of developer credential.Learn more item you would like to review usage for.

4. In the Billing cycle selector, choose a billing cycle to inspect. The main panel of the window will show a usage report.

   

5. Review the usage report for your OAuth credentialsOAuth credentials are an item that contains parameters required to implement user authentication or app authentication, including a client_id, client_secret, and redirect URIs. They are a type of developer credential.Learn more. Usage information is organized by secure resourceA secure resource is any item or service in an ArcGIS that requires an ArcGIS account and authentication to access. Examples include ArcGIS Location Services, and items and data services in an ArcGIS portal.Learn more. Click Download CSV to download the information as a .csv file.

   

6. Click the dropdown button on a specific service to view a usage timeline. The panel will show the resource consumption for each day of the billing cycle.