Scripts that use the ArcGIS API for Python to accomplish any automated task within ArcGIS Online usually need to connect to the ArcGIS Online organization first. The easiest way to do this is to hardcode your password into the script. Any of us who have worked with the ArcGIS API for Python are familiar with these ubiquitous lines:
<SPAN class="keyword token">from</SPAN> arcgis<SPAN class="punctuation token">.</SPAN>gis <SPAN class="keyword token">import</SPAN> GIS
gis <SPAN class="operator token">=</SPAN> GIS<SPAN class="punctuation token">(</SPAN><SPAN class="string token">"https://arcgis.com"</SPAN><SPAN class="punctuation token">,</SPAN> <SPAN class="string token">"Username"</SPAN><SPAN class="punctuation token">,</SPAN> <SPAN class="string token">"Password"</SPAN><SPAN class="punctuation token">)</SPAN><SPAN class="line-numbers-rows"><SPAN></SPAN><SPAN></SPAN></SPAN>
However, the reality is that hardcoding passwords into scripts is a security risk for a number of reasons. One of the most common risks is the propensity to mistakenly share a script to a public repository or with colleagues that still contains your embedded password. Thankfully, there are multiple approaches for authenticating to the GIS that remove the password from the script and do not require any sort of login prompt (meaning they can run automatically without human interaction to type a password).
Option 1: Store your credentials to a profile
This is recommended in the API guide. The profile parameter uses the keyring library to store your username in an unencrypted config file and securely store your password in the operating system's password manager. Once you set the profile, you can log in using just the profile name, referencing the credentials stored in the config file and password manager associated with that specific profile. The sample below shows how to get started:
<SPAN class="comment token">### Set up a profile</SPAN>
<SPAN class="keyword token">from</SPAN> arcgis<SPAN class="punctuation token">.</SPAN>gis <SPAN class="keyword token">import</SPAN> GIS
gis_profile <SPAN class="operator token">=</SPAN> GIS<SPAN class="punctuation token">(</SPAN><SPAN class="string token">"https://arcgis.com"</SPAN><SPAN class="punctuation token">,</SPAN> <SPAN class="string token">"my_username"</SPAN><SPAN class="punctuation token">,</SPAN> <SPAN class="string token">"my_password"</SPAN><SPAN class="punctuation token">,</SPAN> profile<SPAN class="operator token">=</SPAN><SPAN class="string token">"Esri Support Admin"</SPAN><SPAN class="punctuation token">)</SPAN>
<SPAN class="keyword token">print</SPAN><SPAN class="punctuation token">(</SPAN><SPAN class="string token">"Profile defined for {}"</SPAN><SPAN class="punctuation token">.</SPAN>format<SPAN class="punctuation token">(</SPAN>gis_profile<SPAN class="punctuation token">)</SPAN><SPAN class="punctuation token">)</SPAN><SPAN class="line-numbers-rows"><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN></SPAN>Profile defined for GIS @ https://<myOrg>.maps.arcgis.com version:8.3
Now that we've established the profile, we can connect to the GIS using only the profile parameter:
<SPAN class="comment token">### Log in with a profile</SPAN>
<SPAN class="keyword token">from</SPAN> arcgis<SPAN class="punctuation token">.</SPAN>gis <SPAN class="keyword token">import</SPAN> GIS
gis <SPAN class="operator token">=</SPAN> GIS<SPAN class="punctuation token">(</SPAN><SPAN class="string token">"https://arcgis.com"</SPAN><SPAN class="punctuation token">,</SPAN> profile<SPAN class="operator token">=</SPAN><SPAN class="string token">"Esri Support Admin"</SPAN><SPAN class="punctuation token">)</SPAN>
<SPAN class="keyword token">print</SPAN><SPAN class="punctuation token">(</SPAN><SPAN class="string token">"Connected to the GIS as {}."</SPAN><SPAN class="punctuation token">.</SPAN>format<SPAN class="punctuation token">(</SPAN>gis<SPAN class="punctuation token">.</SPAN>properties<SPAN class="punctuation token">.</SPAN>user<SPAN class="punctuation token">.</SPAN>username<SPAN class="punctuation token">)</SPAN><SPAN class="punctuation token">)</SPAN><SPAN class="line-numbers-rows"><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN></SPAN>Connected to the GIS as my_username.
Option 2: Directly access keyring to store your password
Keyring is installed in the ArcGIS Pro default Python environment and can be used to securely store a password in the operating system's password manager.
The concept is similar to setting a profile and accessing it later. The first step is to set the password, and optionally verify that the password has been stored as you expect. ArcGISOnline is set as the argument for the system parameter, used to keep track of which passwords go with which usernames.
<SPAN class="comment token">### Set password and optionally verify storage</SPAN>
<SPAN class="keyword token">import</SPAN> keyring
keyring<SPAN class="punctuation token">.</SPAN>set_password<SPAN class="punctuation token">(</SPAN><SPAN class="string token">"ArcGISOnline"</SPAN><SPAN class="punctuation token">,</SPAN> <SPAN class="string token">"my_username"</SPAN><SPAN class="punctuation token">,</SPAN> <SPAN class="string token">"my_password"</SPAN><SPAN class="punctuation token">)</SPAN>
<SPAN class="comment token">#Optionally verify password storage</SPAN>
pw <SPAN class="operator token">=</SPAN> keyring<SPAN class="punctuation token">.</SPAN>get_password<SPAN class="punctuation token">(</SPAN><SPAN class="string token">"ArcGISOnline"</SPAN><SPAN class="punctuation token">,</SPAN> <SPAN class="string token">"my_username"</SPAN><SPAN class="punctuation token">)</SPAN>
<SPAN class="keyword token">print</SPAN><SPAN class="punctuation token">(</SPAN>pw<SPAN class="punctuation token">)</SPAN><SPAN class="line-numbers-rows"><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN></SPAN>
my_password
With the password set, you can use the get_password() method to retrieve the needed password from the operating system's password manager to sign into the GIS. Since we set ArcGISOnline as the system in the code above, we'll need to use it to retrieve the correct password:
<SPAN class="comment token">### Access the stored password with keyring and sign into the GIS</SPAN>
<SPAN class="keyword token">from</SPAN> arcgis<SPAN class="punctuation token">.</SPAN>gis <SPAN class="keyword token">import</SPAN> GIS
<SPAN class="keyword token">import</SPAN> keyring
pw <SPAN class="operator token">=</SPAN> keyring<SPAN class="punctuation token">.</SPAN>get_password<SPAN class="punctuation token">(</SPAN><SPAN class="string token">"ArcGISOnline"</SPAN><SPAN class="punctuation token">,</SPAN> <SPAN class="string token">"my_username"</SPAN><SPAN class="punctuation token">)</SPAN>
gis <SPAN class="operator token">=</SPAN> GIS<SPAN class="punctuation token">(</SPAN><SPAN class="string token">"https://arcgis.com"</SPAN><SPAN class="punctuation token">,</SPAN> <SPAN class="string token">"my_username"</SPAN><SPAN class="punctuation token">,</SPAN> pw<SPAN class="punctuation token">)</SPAN>
<SPAN class="keyword token">print</SPAN><SPAN class="punctuation token">(</SPAN><SPAN class="string token">"Connected to the GIS"</SPAN><SPAN class="punctuation token">)</SPAN><SPAN class="line-numbers-rows"><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN></SPAN>
Connected to the GIS
Option 3: Use the active ArcGIS Pro connection
Connecting to the GIS using the active ArcGIS Pro connection is also covered in the API Guide. No credentials are required; you just need to make sure ArcGIS Pro is on your machine and you are connected to the intended ArcGIS Online organization. The really advantageous part about using the Pro connection is that it works with SAML logins; so if you need to automate a script that requires authentication and don't have/do not want to use built-in users, this method is the way to go. To leverage the Pro connection without ArcGIS Pro concurrently running, you'll need to select "Sign me in automatically" when connecting to organization in ArcGIS Pro or take your license offline.
<SPAN class="comment token">### Use the active Pro connection</SPAN>
<SPAN class="comment token">### This example uses a SAML login</SPAN>
<SPAN class="keyword token">from</SPAN> arcgis <SPAN class="keyword token">import</SPAN> GIS
gis <SPAN class="operator token">=</SPAN> GIS<SPAN class="punctuation token">(</SPAN><SPAN class="string token">"Pro"</SPAN><SPAN class="punctuation token">)</SPAN>
<SPAN class="keyword token">print</SPAN><SPAN class="punctuation token">(</SPAN>gis<SPAN class="punctuation token">)</SPAN><SPAN class="line-numbers-rows"><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN><SPAN></SPAN></SPAN>
GIS @ https://<myOrg>.maps.arcgis.com/ version:8.3
--------------------
I hope you found these tips helpful for securely automating authentication using the ArcGIS API for Python! Thanks for reading, and please let me know any feedback in the comments below.
