How to create API Key properly as a token, to create shareable layer service url

Question

From my ArcGIS Online account, I need to share my private layer with a customer in a simple way, so he'd be able to add it to his scene, and hence, to his web application. I found an article from Sep 15, 2023 "Leveraging API Keys for Un-Credentialed Access to Hosted Layers" referring exactly that issue. It explains that by appending the API key as a token to the private layer url, thus: ?token=, we have created a "shareable url", that can be used by the customer as if the layer was public. The article speaks about "set up your scope", but I have not succeeded to see and understand what it meant... In my api key "Edit Item access" I enabled the layer and its service url, and I even have set the referrer to the domain of the layer service url, hoping that this is what was meant by "set up your scope". But when setting it as an address in chrome, I got an err msg: "invalid token", even without requesting username and password, as in the article's example. I suspect that I have not yet succeeded to define the API Key exactly as needed, but I don't know what is the error and how to fix it. I hope an elaborated example and some explanation could help. I attach screenshot of that API Key privileges, referrers and Item access

ChrisLandvogt · Accepted Answer

Hi @MichaelLev I just tested it with a tile layer in ArcGIS Online. (no referrer domain in the API key, I just added the items I wanted it to link to)

e.g. https://tiles.arcgis.com/tiles/vHnIGBHHqDRy0CR/arcgis/rest/services/Test_WTL1/MapServer (just an example this doesn't work)

Append the API key

https://tiles.arcgis.com/tiles/vHnIGBHHqDRy0CR/arcgis/rest/services/Test_WTL1/MapServer?token=your_token_here

Open in incognito and it works. I'm not sure that I understand the remainder of the question. I'm happy to try to help, but your local Esri support may be able to investigate also,

Hope this helps.

Regards, Chris

MichaelLev · Accepted Answer

Thank you again, @ChrisLandvogt , indeed if I left referrers empty and enabled the service and the layer in the API Key and opened incognito, the shared url worked to show the json.

But if I try to add the shared url to a scene in another ArcGIS Online, I can't...

Maybe you can enlighten my eyes also in this aspect - how to add the shared url to a scene in another portal?

ChrisLandvogt · Accepted Answer

No problems @MichaelLev - I have found the same, in my other organisation, the token is not accepted (even when added manually as parameters) and it attempts to authenticate using credentials rather than the API key. For this - I would recommend you create a support case to get clarity on whether this is a supported workflow. The typical method would be to share the layer across the organisations through groups, a partnered/distributed collaboration, or embedding credentials  (depending if ArcGIS Online or Enterprise. Good luck with the support case - I encourage you to post how you go here for the benefit of the broader Esri community. Cheers - Chris