Are tokens OK on public feature services?

MattStayner — Tue, 15 Jan 2019 22:35:42 GMT

I have a web app that uses OAuth2 to authenticate Esri named users. I have an access token for the user and, if the feature service is "secured" (not shared with public), I append the token to the feature service to load it (e.g. "[feature service url]?token=[token]") .

It used to be that if I appended the token to a "public" feature service (share with everyone), then I would get an error and the service wouldn't load. That meant I would have to track which services were "secured" and which were "public" and request the data accordingly.

I noticed on AGOL the other day when I looked at the details page of a "public" feature service that an access token was appended to it. I thought that was interesting, so I started experimenting. It appears that I can now append an any Esri access token to a "public" feature service and it will still load as long as the token is valid.

I have 3 questions on this topic:

Is my understanding correct, that you can append an access token to a "public" feature service and it will still load?
If that is correct, when was the change made? Is it documented somewhere?
Will that always work in the future? If so, I am going to simplify my codebase and always append an access token to feature services. If it is uncertain, I might need to leave it all in "just in case".

Thanks!

topic Are tokens OK on public feature services? in ArcGIS REST APIs and Services Questions

Are tokens OK on public feature services?