ArcGIS supports secure access to location services and private data. It ensures that only valid, authorized users and applications access protected information. To access secure resources, implement an authentication method so your applications can make authenticated requests to services.
An authentication method is a process used to obtain an access token. Your app must present an access token when it makes a request to an ArcGIS location service. Access tokens define the scope and permissions available to your application. The type of authentication you use to get an access token will vary.
There are two methods for authenticating users and three types of authentication that can be used to obtain an access token:
- API key: A simple method to authenticate users.
- API key authentication: This creates a permanent token that grants your application access to location services and, with an ArcGIS developer account, private content (currently in Beta).
- OAuth 2.0: This method uses application credentials to manage and authorize access for authenticated users.
- User authentication (formerly ArcGIS identity): This generates a short-lived token via OAuth 2.0, authorizing your application to access ArcGIS content, services, and resources on behalf of a logged-in ArcGIS user.
- App credential authentication: This generates a short-lived token via OAuth 2.0, authorizing a developer's application to access ready-to-use services on their behalf.
To make authenticated requests to services, you need to set the token parameter to an access token.
API key authentication
An API key is a long-term access token that you manually create, configure, and scope using the developer dashboard. Using API keys is typically the easiest way to access ArcGIS location services in your applications.
To use API keys, you need to have one of the following ArcGIS accounts:
- ArcGIS Developer account
- ArcGIS Online account
Use API keys when you want to:
- Quickly write applications that consume ready-to-use services.
- Provide access to services without requiring users to sign in with an ArcGIS account.
- Use an access token that doesn't expire.
- Meter service usage to the ArcGIS subscription that owns the API key.
You can set a global API key to use across different levels in a project.
To set a global API key:
Go to Edit -> Project Settings, select ArcGIS Maps SDK under the Plugins tab, and enter the API key. You need to reload the level to see the map.
To set an API key for a specific level:
-
You need an ArcGIS Developer account or ArcGIS Online account and an API key to access ArcGIS services. If you don't have an account, sign up for free.
-
Open the Modes Panel UI in the Unreal Engine, and click on the Auth tab.
-
Set the API key in the API Key field.
With the Modes Panel UI, the API key is used for all your content. If you want to use different API keys for each data, use Blueprints or the C++ API.
-
You need an ArcGIS Developer account or ArcGIS Online account and an API key to access ArcGIS services. If you don't have an account, sign up for free.
-
Go to Unreal Engine, and click on the Actor with the ArcGIS Map Component in the Outliner.
-
Open the Authentication section and set the API key in the API Key field.
With components, the API key is used for all your content. If you want to use different API keys for each data, use Blueprints or the C++ API.
To use API keys you need an ArcGIS Developer account or ArcGIS Online account and an API key to access ArcGIS services. If you don't have an account, sign up for free.
You can set API keys for basemap, elevation, and layers. Create a string variable for each API key and connect them to the API key pin accordingly.
To use API keys you need an ArcGIS Developer account or ArcGIS Online account and an API key to access ArcGIS location services. If you don't have an account, sign up for free.
You can set API keys for basemap, elevation, and layers. Set the API key string in the constructor.
You can find the sample code to use an API key for all the layers in ArcGIS Map in the SampleAPIMapCreator.cpp file. The sample script file is in:
Plugins/ArcGISMapsSDK/Source/ArcGISSamples/Private
OAuth 2.0
OAuth 2.0 is an industry standard protocol for authorization. ArcGIS stores private user identities and content; 3rd party applications access those resources through a secure OAuth 2.0 user authorization protocol.
User authentication
User authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth 2.0. When a user signs into an application, an access token is granted that authorizes the application to access services and content on their behalf. The resources and functionality available to the application depend on the user type, roles, and privileges assigned to the user's ArcGIS account.
Implement user authentication when you want to:
- Ensure users are signed in and authenticated with their own ArcGIS account.
- Meter service usage to your app user's ArcGIS subscription to pay for their private data, content, or service transactions.
- Limit the length of time users can be signed in to your app with a temporary token.
To set up OAuth 2.0 with user authentication:
For editor mode, there is a sample OAuth challenge handler that configures OAuth 2.0 with user authentication. To load private data in the Viewport during the editor time:
- Have an ArcGIS account, register an OAuth app, and have a Client ID and Redirect URI for your app to access a private layer. If you don't have an account, sign up for free.
- Open the Modes Panel UI and click the Auth tab.
- In the Add Authentication Configuration section, set a name for the configuration and set the Client ID and the Redirect URI for the private content.
- Click the Add button.
- Click the tab where you have private content, such as Basemap, Elevation, or Layers, and select the configuration name from the Authentication drop-down.
- Save and reload the level if the login pop-up window does not open.
When you add a configuration, you can find it under the Authentication Configurations section. When you reload your level, a login pop-up window opens. To add basemap, elevation, and layers, see the Layers section.
For play mode, you should configure another OAuth challenge handler for your own app. You can attach your own script or the Sample OAuth Authentication Challenge Handler Component (which uses the sample scripts) to the Actor with the ArcGIS Map Component.
- Click ArcGIS Map in the Outliner.
- In the Details panel, click the + Add button.
- Select Sample OAuth Authentication Challenge Handler.
When the secured feature service data is loaded, the login pop-up window will open.
For the editor mode, there is a sample OAuth challenge handler that helps you to configure OAuth 2.0 with user authentication. To load private data in the Viewport during the editor time, complete the following steps:
- Have an ArcGIS account, register an OAuth app, and have a Client ID and Redirect URI for your app to access a private layer. If you don't have an account, sign up for free.
- Go to Unreal Engine, and click the Actor with the ArcGIS Map Component in the Outliner.
- Open the Authentication section.
- Click the + icon to add fields for a set of configurations under Authentication Configurations.
- In the newly added fields, set the configuration name, and add the Client ID and the Redirect URI for the private content.
- Under the section where you have private content, select the configuration name from the Authentication drop-down.
- Save and reload the level if the login pop-up window does not open.
When you reload your level, the login pop-up window opens. For adding basemap, elevation, and layers, see the Layers section.
For play mode, you should configure another OAuth challenge handler for your own app. You can attach your own script or attach the Sample OAuth Authentication Challenge Handler Component (which uses the sample scripts) to the Actor using the ArcGIS Map Component.
- Click ArcGIS Map in the Outliner.
- In the Details panel, click the + Add button.
- Select Sample OAuth Authentication Challenge Handler.
When the secured feature service data is loaded, the login pop-up window will open.
To implement user authentication, you should have an ArcGIS account and a Client ID and Redirect URI for your app to access a private layer. If you don't have an account, sign up for free.
Configure the Client ID and the Redirect URI with ArcGISOAuth for the private content, and register it with the private content URL to the ArcGISAuthentication. If you want to use a new OAuth configuration, clear the registered configurations from the ArcGISAuthentication before you add it.
Use Authentication to set OAuth challenge handler.
To add private content, see the Layers section.
You can find how to implement user authentication with C++ in the ArcGIS Map Component.cpp and ArcGIS Map Component.h. Both files are stored in:
Plugins/ArcGISMapsSDK/Source/ArcGISMapsSDK
Open the Public or Private folder and find the files stored in the Components folder hierarchy.
You can also find the files for the Sample OAuth Authentication Challenge Handler and Sample OAuth Authentication Challenge Handler Component in:
Plugins/ArcGISMapsSDK/Source/ArcGISSamples
Open the Public or Private folder and find the files in the Security folder.
App credential authentication
App credential authentication uses a set of application credentials to grant a short-lived access token generated via OAuth 2.0. The token authorizes your application to access ready-to-use services, such as basemap layers, search, and routing.
Use application credentials when you want to:
- Access ready-to-use services with a more secure process and a short-lived token.
- Provide access to services without requiring users to have an ArcGIS account.
Choose an authentication method
The choice of which type of authentication to implement is mostly dependent upon the resources required by your application.
| Scenario | Solution |
|---|---|
| Your app requires access only to ready-to-use services, such as the basemap layer, geocoding, or routing services. | API key |
| Your app allows users to view and edit private data in ArcGIS. | User authentication |
| Your app is API backend and requires access only to basemaps and geocoding. | App credential authentication |