Clarification About Licenses/API Key

RTC

Our app has free and licensed users. For licensed users a named user license is used. For free users, we use a license string. With the free users using a license string we cannot load Esri basemaps without adding our API Key to the app. However, adding the API Key seems to also override a Name Users license so they cannot load there private secure maps. Our workaround is to remove the API Key once the user logs in but this is not ideal. Is there a better way to handle this?

Thanks!

Nicholas-Furness

Hi.

This is likely not a licensing issue. API Keys don't impact licensing at all. They just provide access to services.

Here's what I think is happening:

I am taking a guess, but I expect that when you use an API Key, you are setting it globally on ArcGISEnvironment. When that happens, the SDK blindly uses that API Key across the board and doesn't even try the AuthenticationManager workflows, which are responsible for getting suitable access tokens for various services - in this case your logged-in user's access token via OAuth which will confer access to those web maps.

To use both API Keys and named user access tokens, one brute-force approach is what you're doing now - you unset that global API Key, and the SDK will then get a token for the user in question, which of course gives them access to their web maps.

A more refined approach might be to set the API Key specifically on the Basemap objects you create in code, and not at the global ArcGISEnvironment level. The key there is that Basemap implements APIKeyResource (scroll down to see which classes support this). Here's the full list of API classes that are APIKeyResources:

 

This means you can specifically set an API Key on any of these, which will take precedence over any other token we might have (or try to get hold of) for that item through AuthenticationManager. If an API Key is NOT set, then the SDK will use AuthenticationManager. You could even use separate API Keys for RouteTask, LocatorTask, and Basemaps you create in code if you wanted, and the SDK will then fall back to AuthenticationManager for everything else.

In a little more detail… when determining which access token to use for a remote resource, the SDK follows this logic:

1. Does the object (e.g. RouteTask) have an API Key set on it explicitly? If so, use that.
2. If not, is there a global API Key set on ArcGISEnvironment? If so, use that.
3. If not, let's ask AuthenticationManager for an access token (e.g. OAuth, or your custom authentication challenge handler, etc.).

Hope that helps.

P.S. When I talk about API Keys above, I mean in the context of Location Platform and ArcGIS Online; the Native Maps SDKs do not yet support ArcGIS Enterprise API Keys.