Security and authentication

ArcGIS supports secure access to ArcGIS servicesA service, also known as an ArcGIS service, is software that supports an ArcGIS REST API and provides geospatial functionality or data. A service can be hosted by Esri or in ArcGIS Enterprise.Learn more and portal items. It ensures that only valid, authorized users and services can access protected information. To access secure ArcGIS resources, you need an access tokenAn access token is an authorization string that provides access to secure ArcGIS content, data, and services. Its capabilities are determined by the privileges it supports. It is obtained by implementing API key authentication, User authentication, or App authentication.Learn more that you can obtain by implementing an authentication workflow in your app. The type of authentication you use depends on the security and access requirements of your app.

Learn more about authentication in the following topics:

• Types of authentication—describes the available types of authentication and offers help choosing the right one for your app.
• Types of credentials—lists the available credential types and describes how they're used.
• Implement authentication—provides guidance for implementing authentication in your app using the Authentication toolkit component or the Authentication API.

Tutorials

Access services with OAuth credentials

Learn how to implement user authenticationUser authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth2.0.Learn more to access a secure ArcGIS serviceA service, also known as an ArcGIS service, is software that supports an ArcGIS REST API and provides geospatial functionality or data. A service can be hosted by Esri or in ArcGIS Enterprise.Learn more with OAuth credentialsOAuth credentials are an item that contains parameters required to implement user authentication or app authentication, including a client_id, client_secret, and redirect URIs. They are a type of developer credential.Learn more.

Samples

Authenticate with OAuth