ArcGIS supports secure access to ArcGIS services
The available authentication methods are described below. See the Choose an authentication method section for help determining which type of authentication is best suited to your use case.
Currently, ArcGIS Maps SDK for Unity supports two types of authentication methods:
- API key authentication: grants a long-lived access token to authenticate requests to ArcGIS services
A service, also known as an ArcGIS service, is software that supports an ArcGIS REST API and provides geospatial functionality or data. A service can be hosted by Esri or in ArcGIS Enterprise. and secure portal items. For more information see the Introduction to API key authentication topic. To obtain an API key access token, go to the Create an API key tutorial. Here you can configure the API key privileges required to authorize access to different services and portal items for your ArcGIS accountAn ArcGIS account is an identity with a user type and set of privileges that can access specific ArcGIS products, tools, APIs, services, and resources. The main account types that can be used for development are an ArcGIS Location Platform account, ArcGIS Online account, and ArcGIS Enterprise account. ArcGIS Location Platform and ArcGIS Online accounts are also associated with a subscription. .- API key access tokens created with an ArcGIS Enterprise
An ArcGIS Enterprise account is an identity for an instance of ArcGIS Enterprise. It can be used to access ArcGIS Enterprise tools, applications, and services, and to develop applications. account (from ArcGIS Enterprise version 11.4 onwards), provide access to secure itemsAn item, also known as a content item, is a resource stored in a portal such as a web map, hosted layer, style, script tool, file, or notebook. in an ArcGIS Enterprise portalArcGIS portal, also known as a portal, is a website with applications and tools that can be used to create, manage, access, and share geospatial content and data. It supports security and authentication, developer credentials, content and data service management, user and group management, and site administration. A portal can be hosted in Esri's infrastructure or your own infrastructure. .
- API key access tokens created with an ArcGIS Enterprise
- OAuth 2.0: manage ArcGIS authentication and grant a short-lived access token
An access token is an authorization string that provides access to secure ArcGIS content, data, and services. Its capabilities are determined by the privileges it supports. It is obtained by implementing API key authentication, User authentication, or App authentication. generated via OAuth 2.0. This gives your application permission to access ArcGIS secured services authorized to an existing ArcGIS user's account.- User authentication: a collection of authentication workflows that connect your app to a user's ArcGIS account.
To make authenticated requests to services, you must set the token parameter to an access token
API key authentication
An API key can grant your public-facing application access to specific ArcGIS services
Use API key authentication
- Quickly write applications that consume ArcGIS services
A service, also known as an ArcGIS service, is software that supports an ArcGIS REST API and provides geospatial functionality or data. A service can be hosted by Esri or in ArcGIS Enterprise. . - Provide access to services without requiring users to sign in with an ArcGIS account
An ArcGIS account is an identity with a user type and set of privileges that can access specific ArcGIS products, tools, APIs, services, and resources. The main account types that can be used for development are an ArcGIS Location Platform account, ArcGIS Online account, and ArcGIS Enterprise account. ArcGIS Location Platform and ArcGIS Online accounts are also associated with a subscription. .
Set a global API key for your project
You can set a global API key to use across different scenes in a project.
To set a global API key:
Go to Edit > Project Settings, in the ArcGIS Maps SDK tab, and enter the API key.
Set an API key for a specific scene
To set an API key for a specific scene:
- You need an ArcGIS Location Platform account or ArcGIS Online account and an API key
An API key is a long-lived access token created using API key credentials. They are valid for up to one year and are typically embedded directly into client applications. to access ArcGIS servicesA service, also known as an ArcGIS service, is software that supports an ArcGIS REST API and provides geospatial functionality or data. A service can be hosted by Esri or in ArcGIS Enterprise. . If you don't have an account, sign up for free. - Open the Map Creator UI in the Unity Editor, and click the Auth tab.
- Set the API key in the API Key field.
With the Map Creator UI, the API key is used for all your content. If you want to use different API keys for each data, use the C# API.
OAuth 2.0
OAuth 2.0 is an industry-standard protocol for authorization. ArcGIS stores private user identities and content; 3rd party applications access those resources through a secure OAuth 2.0 user authorization protocol.
User authentication
User authentication is a set of authentication workflows that allow users with an ArcGIS account
Services that your app accesses with user authentication will be billed to the authenticated user's ArcGIS account
Implement user authentication when you want to:
- Ensure users are signed in and authenticated with their own ArcGIS account
An ArcGIS account is an identity with a user type and set of privileges that can access specific ArcGIS products, tools, APIs, services, and resources. The main account types that can be used for development are an ArcGIS Location Platform account, ArcGIS Online account, and ArcGIS Enterprise account. ArcGIS Location Platform and ArcGIS Online accounts are also associated with a subscription. . - Use your app user's credits
Credits are the currency used by ArcGIS Online Organization accounts to account for data storage and location service consumption. Credits are consumed for specific transactions, such as accessing location services, and types of storage, such as storing features, performing analytics, and using premium content. to pay for their private data, contentContent is a collection of items in a portal that belong to a user, group, or organization. , or service transactions. - Limit the length of time users can be signed in to your app with a temporary token.
- Distribute your app through ArcGIS Marketplace.
To set up OAuth 2.0 with user authentication:
For the editor mode, there is a Sample Authentication Handler Initializer that allows you to configure OAuth 2.0 with user authentication. To load private data in the Scene view:
-
Have an ArcGIS account
An ArcGIS account is an identity with a user type and set of privileges that can access specific ArcGIS products, tools, APIs, services, and resources. The main account types that can be used for development are an ArcGIS Location Platform account, ArcGIS Online account, and ArcGIS Enterprise account. ArcGIS Location Platform and ArcGIS Online accounts are also associated with a subscription. , register an OAuth app, and have a Client ID and Redirect URL for your app to access private data. If you don't have an account, sign up for free. -
Open the Map Creator UI and click the Auth tab.
-
In the Authentication Configuration section, click the +Add New button in the lower right corner.
-
Enter the URL for the portal on the Add New Portal Item pop-up window and click Next. URL examples:
- For ArcGIS Online, enter
httpsor://www.arcgis.com https.://yourorg.maps.arcgis.com - For ArcGIS Enterprise, enter
https.://webadaptorhost.domain.com/webadaptorname
- For ArcGIS Online, enter
-
Provide a Portal Name, Client ID, and Redirect URL. Click the Add button.
-
After successfully adding an authentication configuration, it will be displayed under the Authentication Configurations section.
-
To apply the User Authentication to your private data (e.g. private layers from the same portal), select the User Authentication option from the Authentication Type drop-down list.
-
You will be redirected to an external browser window to sign in to your ArcGIS account or grant permissions for OAuth credentials. Save and reload the scene if the login pop-up window does not open.
Standalone builds
To support OAuth authentication in standalone builds or Play mode, configure an OAuth login handler.
You can attach your own script or use the provided sample scripts by attaching the SampleAuthenticationHandlerInitializer component to the game object with the ArcGIS Map Component. This will automatically register the SampleOAuthUserLoginPromptHandler for handling OAuth login prompts during both Play mode and standalone app execution.
- Click ArcGIS Map in the Hierarchy window.
- In the Inspector window, click the Add Components button.
- Select the Sample Authentication Handler Initializer Component.
When the secured feature service data is loaded, the login window will open in the default web browser. Upon successful login, an ArcGISCredential will be created and stored in the ArcGISCredentialStore, where it can be reused and refreshed automatically.
Choose an authentication method
The choice of which type of authentication to implement is mostly dependent upon the resources required by your application.
| Scenario | Solution |
|---|---|
| Your app requires access only to ready-to-use services, such as the basemap layer, geocoding, or routing services. | API key authentication |
| Your app needs to access private data hosted on your ArcGIS Location Platform account | API key authentication |
| Your app allows users to view and edit private data hosted in ArcGIS Online | User authentication |
| Your app requires access to location services | User authentication |
| Your app needs to access content that requires an ArcGIS Online subscription | User authentication |