Authentication

ArcGIS supports secure access to location services and private data. This ensures that only valid, authorized users and applications access protected information. To access secure resources, you must implement an authentication method so your applications can make authenticated requests for services.

An authentication method is a process used to obtain an access token. Your app must present an access token each time it makes a request to an ArcGIS location service. Access tokens define the scope and permissions available to your application. The type of authentication you use to get an access token will vary.

Currently, ArcGIS Maps SDK for Unity supports two types of authentication methods:

API key authentication: grants a long-lived access token to authenticate requests to ArcGIS services and secure portal items. For more information see the Introduction to API key authentication topic. To obtain an API key access token, go to the Create an API key tutorial. Here you can configure the API key privileges required to authorize access to different services and portal items for your ArcGIS account.
- API key access tokens created with an ArcGIS Enterprise account (from ArcGIS Enterprise version 11.4 onwards), provide access to secure items in an ArcGIS Enterprise portal.
OAuth 2.0: manage ArcGIS authentication and grant a short-lived access token generated via OAuth 2.0. This gives your application permission to access ArcGIS secured services authorized to an existing ArcGIS user's account.
- User authentication: a collection of authentication workflows that connect your app to a user's ArcGIS account.

To make authenticated requests to services, you must set the token parameter to an access token.

API key authentication

An API key can grant your public-facing application access to specific ArcGIS services and portal items.

Use API key authentication when you want to:

Quickly write applications that consume ArcGIS services.
Provide access to services without requiring users to sign in with an ArcGIS account.

Learn more about API key authentication

Learn how to create and manage an API key in your portal

Set a global API key for your project

You can set a global API key to use across different scenes in a project.

To set a global API key:

Go to Edit > Project Settings, in the ArcGIS Maps SDK tab, and enter the API key.

Set an API key for a specific scene

To set an API key for a specific scene:

You need an ArcGIS Location Platform account or ArcGIS Online account and an API key to access ArcGIS services. If you don't have an account, sign up for free.
Open the Map Creator UI in the Unity Editor, and click the Auth tab.
Set the API key in the API Key field.

With the Map Creator UI, the API key is used for all your content. If you want to use different API keys for each data, use the C# API.

OAuth 2.0

OAuth 2.0 is an industry-standard protocol for authorization. ArcGIS stores private user identities and content; 3rd party applications access those resources through a secure OAuth 2.0 user authorization protocol.

Learn more about OAuth 2.0

Learn how to register an OAuth application in your portal

User authentication

User authentication is a set of authentication workflows that allow users with an ArcGIS account to sign into an application and access ArcGIS content, services, and resources. The typical authentication protocol used is OAuth2.0. When a user signs into an application with their ArcGIS account, an access token is generated that authorizes the application to access services and content on their behalf. The resources and functionality available depend on the user type, roles, and privileges of the user's ArcGIS account.

Services that your app accesses with user authentication will be billed to the authenticated user's ArcGIS account and its associated ArcGIS subscription. If your application will access your users' secure content in ArcGIS or if you plan to distribute your application through ArcGIS Marketplace, you must use user authentication.

Implement user authentication when you want to:

Ensure users are signed in and authenticated with their own ArcGIS account.
Use your app user's credits to pay for their private data, content, or service transactions.
Limit the length of time users can be signed in to your app with a temporary token.
Distribute your app through ArcGIS Marketplace.

Learn more about user authentication

Learn how to add a Redirect URL in your portal

To set up OAuth 2.0 with user authentication:

For the editor mode, there is a Sample Authentication Handler Initializer that allows you to configure OAuth 2.0 with user authentication. To load private data in the Scene view:

Have an ArcGIS account, register an OAuth app, and have a Client ID and Redirect URL for your app to access private data. If you don't have an account, sign up for free.
Open the Map Creator UI and click the Auth tab.
In the Authentication Configuration section, click the +Add New button in the lower right corner.
Enter the URL for the portal on the Add New Portal Item pop-up window and click Next. URL examples:
- For ArcGIS Online, enter https://www.arcgis.com or https://yourorg.maps.arcgis.com.
- For ArcGIS Enterprise, enter https://webadaptorhost.domain.com/webadaptorname.
Provide a Portal Name, Client ID, and Redirect URL. Click the Add button.
After successfully adding an authentication configuration, it will be displayed under the Authentication Configurations section.
To apply the User Authentication to your private data (e.g. private layers from the same portal), select the User Authentication option from the Authentication Type drop-down list.
You will be redirected to an external browser window to sign in to your ArcGIS account or grant permissions for OAuth credentials. Save and reload the scene if the login pop-up window does not open.

For Play mode and standalone builds, configure another OAuth challenge handler for your own app. You can attach your own script or the OAuth Challenge Handlers Initializer (which uses the sample scripts) to the game object with the ArcGIS Map Component.

Click ArcGIS Map in the Hierarchy window.
In the Inspector window, click the Add Components button.
Select OAuth Challenge Handlers Initializer.

When the secured feature service data is loaded, the login window will open in the default web browser.

For the editor mode, there is a Sample Authentication Handler Initializer that allows you to configure OAuth 2.0 with user authentication. To load private data in the Scene view:

Have an ArcGIS account, register an OAuth app, and have a Client ID and Redirect URL for your app to access private data. If you don't have an account, sign up for free.
Go to the Hierarchy window, and click the game object with the ArcGIS Map Component.
Find and expand the Authentication Configuration section.
Click the + icon to add fields for a set of configurations.
Input the Portal URL, a Portal Name, along with the Client ID and the Redirect URL for accessing private content.
Under the section where you add the private content (e.g. private layers), select the User Authentication option from the Authentication Type drop-down list.
If the portal information is successfully validated, you will be directed to an external browser window to log in to your ArcGIS account or grant permissions for OAuth credentials. If the login pop-up window does not appear, please save and reload the scene.

Click ArcGIS Map in the Hierarchy window.
In the Inspector window, click the Add Components button.
Select OAuth Challenge Handlers Initializer.

When the secured feature service data is loaded, the login window will open in the default web browser.

To implement user authentication, you should have an ArcGIS account and a Client ID and Redirect URL for your app to access a private layer. If you don't have an account, sign up for free.

Configure an ArcGISOAuthUserConfiguration for the private content, and register it with the ArcGISAuthenticationManager. To remove existing OAuth configurations before adding new ones, clear the registered configurations first. Clearing is not required before adding a new configuration.

If you are making a standalone build, use ArcGISAuthenticationManager to set the OAuth user login prompt handler.

To add private content, see the Layers section.

You can find the sample code to implement user authentication with an ArcGIS Map in the OAuthScene.cs file. The sample script file is in:

Assets/Samples/ArcGIS Maps SDK for Unity/[version]/Sample Content/Scenes/Scripts/OAuthScene/

The sample script is used in the OAuthAPISample scene in the Assets/ArcGISMapsSDKSamples/URP or HDRP folder.

You can also find the Sample Authentication Handler Initializer script for desktop and mobile devices in the following folder:

Assets/Samples/ArcGIS Maps SDK for Unity/[version]/Sample Content/Scenes/Scripts/Security/

Choose an authentication method

The choice of which type of authentication to implement is mostly dependent upon the resources required by your application.

Scenario	Solution
Your app requires access only to ready-to-use services, such as the basemap layer, geocoding, or routing services.	API key authentication
Your app needs to access private data hosted on your ArcGIS Location Platform account.	API key authentication
Your app allows users to view and edit private data hosted in ArcGIS Online or ArcGIS Enterprise.	User authentication
Your app requires access to location services only and you want usage charged to the user.	User authentication
Your app needs to access content that requires an ArcGIS Online subscription.	User authentication