This topic introduces the different types of authentication you can implement to get an access token. The type you choose depends on the type of application you are building, the types of resources you need to access, and the functionality you need to support in your application.
The three types of authentication are:
To compare the different types of authentication and see different use cases, go to Authentication comparision.
API key authentication
API key authentication is a type of authentication that uses a long-lived access token embedded directly into an application or console script. The access tokens are called API keys and are created and managed through API key credentials. The privileges of API key credentials can be configured to authorize API keys to access secure ArcGIS services and items.
API key authentication can be used to create public applications that access ArcGIS Location Services and secure content items. It can also be used to create personal scripts that perform spatial analysis and portal management operations.
API key authentication is the easiest type of authentication to set up and is recommended if you are new to ArcGIS.
User authentication
User authentication is a set of authentication workflows that allows ArcGIS users to sign into an application and access secure resources. It requires that all users have an ArcGIS account. The authentication protocol used is OAuth 2.0. When a user signs into an application with their ArcGIS account, an access token is generated that authorizes the application to access services and content on their behalf. The resources and functionality available depend on the user type, roles, and privileges of the user's ArcGIS account. This authentication type was previously known as Named user login and ArcGIS identity.
User authentication generates a unique access token for each user that signs in to your application. Once a user authenticates, the app receives an access token with privileges identical to those of the signed-in user's account. This enables your application to access all content and services the user is authorized to.
App authentication
App authentication is an authentication workflow that grants a short-lived access token via OAuth 2.0. App authentication provides access to similar resources and functionality as API key authentication. Typically, a server-side application component uses a set of OAuth credentials consisting of a client and client to request an access token. The server-side component then passes the resulting access token to a client application.
App authentication can be used to create public applications with a server-side component that access ArcGIS Location Services and secure content items. It can also be used to create web servers or standalone console scripts that perform spatial analysis and portal management operations.
Authentication comparison
Below is a quick comparison of the application type, billing method, privileges, and access token storage and duration for the different types of authentication.
| API key authentication | User authentication | App authentication | |
|---|---|---|---|
| Application type | Public (no sign in required) | Private (sign in required) | Public (no sign in required) |
| Billing | Usage billed to your ArcGIS subscription. | Usage billed to the signed-in user's ArcGIS subscription. | Usage billed to your ArcGIS subscription. |
| Access token privileges | Determined by the properties of the developer credentials. | Determined by privileges of the signed-in user's account. | Determined by the properties of the developer credentials. |
| Access token storage | Static, embedded in the application. | New token created for every signed-in user. | Created upon request and stored in the application. |
| Access token duration | Up to 1 year. | Up to 2 weeks, can be refreshed. | 2 weeks. |
Resources and functionality
The following table provides an overview of the functionality available with each type of authentication:
| API key authentication | User authentication | App authentication | |
|---|---|---|---|
| ArcGIS Location Services | |||
| Data services (Item access) | |||
| Spatial analysis services | 1 | 1 | |
| Portal service (General privileges) | 1 | 1 | |
| Portal service (Admin privileges) | 1 | 1 |
- 1. Supported with ArcGIS Online and ArcGIS Location Platform.
API support
The following table shows the level of API support for each type of authentication:
- 1. Supported via ArcGIS REST JS
Choosing a type of authentication
Answer the following questions to help choose the best type of authentication to implement for the custom application you are building:
-
What is the target audience of your of app?
- Public application (no sign in required): API key authentication or app authentication.
- Private application (ArcGIS sign in required): User authentication.
-
What type of ArcGIS product and account do you have?
- ArcGIS Location Platform: Typically API key authentication or app authentication.
- ArcGIS Online: Typically user authentication, but can implement all types of authentication.
- ArcGIS Enterprise: Typically user authentication, but can implement all types of authentication.
-
Which do you value more, simple implementation or higher security?
- Simple implementation: API key authentication.
- Higher security: User authentication or app authentication.
-
What agent will request an access token?
- Client-side app or web app: API key authentication or user authentication with a PKCE flow.
- Server: App authentication or user authentication with an Authorization code flow.
- Console script: App authentication.
The following table provides use cases for each type of authentication:
| Use case | Solution |
|---|---|
| You are building a public application that requires access to location services. | API key authentication or app authentication |
| You are building a private application intended for members of your organization | User authentication |
| You are building an application on a server or API back-end that will not be seen by users. | API key authentication or app authentication |
| You are building an application that will read private hosted data on your ArcGIS account. | API key authentication or app authentication |
| You are building an application that will read private hosted data from the ArcGIS accounts of organization members. | User authentication |
| You are building a personal automation script to perform tasks with the portal service or spatial analysis services. | API key authentication |
| You are building an application that enables users to perform management tasks with the portal service | User authentication |
| You are building an application that enables users to perform spatial analysis. | User authentication |
| You are building an application using an ArcGIS API. | API key authentication, app authentication, or user authentication |