topic Re: Get Basemaps without exposing API Key in ArcGIS JavaScript Maps SDK Questions

Get Basemaps without exposing API Key

LightmobieLDA — Wed, 23 Apr 2025 14:18:55 GMT

I'm building an aplication using leaflet JS for a company and i want to use the esri basemaps URL to get the tiles for the map. By following the tutorials I got a solution where I created an API key that I use to get this information, but it exposes the API Key in the js. I did not like this approach so I built an API endpoint that act as a middleware and joins the esri basemaps URL with the API key token. However this approach proves enificient since some HTTP get request take several seconds to return.
I am using plain HTML and js with the library Leaflet, I may use the Esri-leaflet integration library but the problem persist.

Am I missing something, or is there another approach to solve this problem?

Re: Get Basemaps without exposing API Key

Noah-Sager — Wed, 23 Apr 2025 14:44:52 GMT

Hi @LightmobieLDA, thanks for posting your question here. While we recommend using an API Key with basemaps in our tutorials, API Keys are not required for every basemap.

Legacy basemaps still work without an API Key, like `gray` or `gray-vector` as seen in this example:

https://developers.arcgis.com/javascript/latest/sample-code/sandbox/?sample=query-attribute-bins

And documented here:

https://developers.arcgis.com/javascript/latest/api-reference/esri-Map.html#basemap:~:text=The%20legacy%20basemaps%20can%20be%20accessed%20using%20the%20basemap%20id%20in%20the%20table%20below.

Re: Get Basemaps without exposing API Key

LightmobieLDA — Thu, 24 Apr 2025 09:37:35 GMT

Hi @Noah-Sager, thanks for the rapid response. The company will use the application that I'm building as a commercial product, and it was my understanding that the API key was necessary to keep track of the credits that are being used. I was able to translate the code that you provided to our use case (thank you very much), but my biggest concern is the legal aspect. How do you know that is my account that is requesting the an API Request without the token?

Re: Get Basemaps without exposing API Key

Edvinas_S — Fri, 25 Apr 2025 08:42:09 GMT

If a service does not require any kind of authentication (like a log-in or an API key), that means it doesn't use your credits and it doesn't know who is sending requests. Weather or not you can use these free-of-charge services in a commercial product depends on the license. My guess is that it would be ok to use esri default basemaps. You should contact Esri support to make sure.

Re: Get Basemaps without exposing API Key

Noah-Sager — Fri, 25 Apr 2025 16:50:40 GMT

Unfortunately, I don't know much about the legal aspects. I would take @Edvinas_S's recommendation and account your account manager with Esri. We do have this page on licensing and attribution for the JS SDK: https://developers.arcgis.com/javascript/latest/licensing/

Re: Get Basemaps without exposing API Key

LightmobieLDA — Tue, 29 Apr 2025 09:23:29 GMT

Thank you very much for your feedback and help @Edvinas_S and @Noah-Sager. I will follow your advise.