Need working Authorization Code Flow sample for ArcGIS Maps SDK for JavaScript 4.x

MattStayner — Thu, 25 Sep 2025 17:08:02 GMT

Hi everyone,

We're running into issues trying to implement the Authorization Code Flow for user authentication in our custom web application using the ArcGIS Maps SDK for JavaScript (4.x). We are following the official documentation, specifically: https://developers.arcgis.com/documentation/security-and-authentication/user-authentication/flows/authorization-code-flow/

We are trying to implement the full two-step process—receiving the authorization code and manually exchanging it for an access_token—because we need to manage the user session and token refresh on our backend (Node.js/C#/etc.) rather than relying solely on the client-side IdentityManager's implicit flow.

Specific Requests

Working Server-Side Exchange Sample: Does anyone have a fully functional, complete, end-to-end sample project (ideally on GitHub or a code sandbox) that demonstrates the server-side exchange of the authorization code for an access token using a standard web framework (e.g., Node.js/Express, Python/Flask, etc.)?
Registering Server-Side Tokens with IdentityManager: We also need a clear code sample demonstrating how to take a token received from our server and correctly register it with the IdentityManager on the client-side. We're using IdentityManager.registerToken() but are unsure if we're configuring it correctly for ArcGIS Enterprise.

🚧What We've Tried/Our Setup

To help with troubleshooting, here is our current setup and the problem we are encountering:

SDK Version: ArcGIS Maps SDK for JavaScript (4.x)
Authentication Flow: Authorization Code Flow with PKCE
The Problem: The client-side part of our application is failing when we try to register the token we get back from our server. We are receiving a TypeError: Cannot read properties of undefined (reading 'toLowerCase') error in the browser console. This error occurs specifically when we try to load a secured layer after receiving the token.

This seems to indicate that one of the parameters we are passing to a Maps SDK function, likely IdentityManager.registerToken(), is not available, or there is some kind of timing issue.

🌐ArcGIS Online vs. ArcGIS Enterprise

We have a key observation that might point to a specific Enterprise configuration issue:

We have been able to get this entire process working successfully when authenticating against ArcGIS Online.
However, the same code and process fails when we attempt it against our on-premise ArcGIS Enterprise portal, even after trying multiple user accounts.

Any guidance, links to working code, or insight into common pitfalls when manually implementing the token exchange with ArcGIS Online/Enterprise would be greatly appreciated!

Thanks in advance!

Re: Need working Authorization Code Flow sample for ArcGIS Maps SDK for JavaScript 4.x

NicolasGIS — Thu, 13 Nov 2025 16:41:26 GMT

hi,

When using registerToken, does your token follow the typing ?

https://developers.arcgis.com/javascript/latest/api-reference/esri-identity-IdentityManager.html#registerToken

Pretty sure you are missing “server” from the error. At least something seems missing…

Just a wild guess

Re: Need working Authorization Code Flow sample for ArcGIS Maps SDK for JavaScript 4.x

MattStayner — Thu, 13 Nov 2025 19:12:40 GMT

We finally got it working by using Identity Manager to sign in, then using the Identity Manager event listener. For some reason, the window event listener didn't work for us.

I still think it would be amazing if someone at Esri could set up a fully functioning example of Authorization code flow with PKCE

That is how we need to sign in now, not using Implicit flow, so give us an example of how it works, start to finish. Thanks!

topic Re: Need working Authorization Code Flow sample for ArcGIS Maps SDK for JavaScript 4.x in ArcGIS JavaScript Maps SDK Questions

Need working Authorization Code Flow sample for ArcGIS Maps SDK for JavaScript 4.x

Specific Requests

🚧What We've Tried/Our Setup

🌐ArcGIS Online vs. ArcGIS Enterprise

Re: Need working Authorization Code Flow sample for ArcGIS Maps SDK for JavaScript 4.x

Re: Need working Authorization Code Flow sample for ArcGIS Maps SDK for JavaScript 4.x