topic Re: Using Python to generate access token for an account that uses organization login in ArcGIS REST APIs and Services Questions

Using Python to generate access token for an account that uses organization login

FelipeDias — Thu, 23 Feb 2023 16:56:44 GMT

Hi there!

I've been trying to generate a REST API access token for an item on ArcGIS online through a basic Python script and I'm having a hard time.

Here are the URLs of the item that I want to access:

ArcGIS Online URL: https://mycompany.maps.arcgis.com/home/item.html?id=41f6ee459c664aeb98a3fab39139c896
REST API URL: https://services9.arcgis.com/eNX73FDxjlKFtCtH/arcgis/rest/services/layername/FeatureServer

Note: You won't be able to access the item above because it's not shared publicly (which is why I want to generate an access token in the first place).

I followed the instructions found here (Generate Token in REST) and arrived at the following Python code (substituting the placeholders with my actual username and password):

import requests tokenURL = 'https://services9.arcgis.com/sharing/rest/generateToken' params = {'f': 'pjson', 'username': 'placeholder_username', 'password': 'placeholder_password', 'referer': 'http://www.arcgis.com'} response = requests.post(tokenURL, data = params, verify = False) token = response.json()['token']

The problem is that the code above doesn't work. When I investigate the response object, I notice two things:

It doesn't have a "token" key.
It tells me that the URL I used is invalid.

print(response.json()) # {'error': {'code': 400, 'message': 'Invalid URL', 'details': ['Invalid URL']}}

So I tried using tokenURL='https://www.arcgis.com/sharing/rest/generateToken', but that didn't work either:

print(response.json()) # {'error': {'code': 400, 'message': 'Unable to generate token.', 'details': ['Invalid username or password.']}}

I believe this might be because I typically log into ArcGIS online through my organization's URL: mycompany.maps.arcgis.com (as seen below):

So I finally tried to use tokenURL='https://mycompany.maps.arcgis.com/sharing/rest/generateToken', but that didn't work either:

print(response.json()) # {'error': {'code': 400, # 'message': 'Unable to generate token.', # 'details': ['Invalid username or password.']}}

Does anyone know what I need to do to successfully generate an access token for the item above?

Re: Using Python to generate access token for an account that uses organization login

LongDinh — Thu, 13 Jan 2022 23:35:02 GMT

Hi @FelipeDias ,

Try using this endpoint instead /sharing/generateToken . Your request should be something like:

import requests organisationName = "orgName" url = f"https://{organisationName}.maps.arcgis.com/sharing/generateToken" username = "NamedUserAccount" password = "Password123" payload={'f': 'json', 'username': username, 'password': password, 'referer': f"https://{organisationName}.maps.arcgis.com/"} response = requests.request("POST", url, data=payload) print(response.json())

You can check to see if the token works by requesting some content from your named user's contents with the following request:

organisationName = "orgName" url = f"https://{organisationName}.maps.arcgis.com/sharing/rest/content/users/{username}" token = response.json()['token'] params={ 'f':'json', 'num':1, 'token': token } userContents = requests.request("GET", url, params=params) print(userContents.json())

Re: Using Python to generate access token for an account that uses organization login

FelipeDias — Thu, 13 Jan 2022 23:41:03 GMT

Thanks for the quick reply!!! Sadly, it didn't work, though... This is what got inside the `response` item:

print(response.json())

{'error': {'code': 400, 'message': 'Unable to generate token.', 'details': ['Invalid username or password.']}}

Any idea what's going on?

Re: Using Python to generate access token for an account that uses organization login

LongDinh — Thu, 13 Jan 2022 23:44:19 GMT

Are you using a valid account? It needs to be a named user account

Re: Using Python to generate access token for an account that uses organization login

FelipeDias — Thu, 23 Feb 2023 16:55:53 GMT

I am. Here's a snapshot of my user profile (I've edited the actual username for privacy):

But as I mentioned in my original post, I don't log in to ArcGIS online though the default portal. Instead, I use my company's organization URL. I have the feeling that that is what's causing the issues here.

Re: Using Python to generate access token for an account that uses organization login

LongDinh — Fri, 14 Jan 2022 00:07:33 GMT

That looks like a Azure Directory account linked to your organisation's ArcGIS Online. You should either:

Use your organisation's ArcGIS Online named user administration account, or
Have your ArcGIS Online named user administration account create a named user for purposes of generating tokens.

The later is generally the preferred solution as you should set up the contents/groups shared to the named user so that it has limited access to items in your organisation's ArcGIS Online

Re: Using Python to generate access token for an account that uses organization login

FelipeDias — Fri, 14 Jan 2022 00:13:30 GMT

Great, I'll reach out to our IT folks and see if they can generate that for me. I'll report back here if it worked later! Thanks!!!!

Re: Using Python to generate access token for an account that uses organization login

alex_friant — Mon, 20 Jun 2022 20:56:09 GMT

Did it end up working?

Re: Using Python to generate access token for an account that uses organization login

MarkGambordella — Tue, 07 Nov 2023 19:42:15 GMT

Also would like to know if it worked. I work for the City and sign in through our organizations login. I have a script that i run but get the following error message:

Error: Line 34 -- "token = response.json()['token']": 'token'
Failed script Attachments to Popup...
Failed to execute (AttachmentstoPopup).

Re: Using Python to generate access token for an account that uses organization login

MarkGambordella — Wed, 08 Nov 2023 21:46:31 GMT

I found a work around. Had to create a built-in account and use that as the user/password instead of the SAML account. It worked and was able to generate a token using this geoprocessing tool below.

Show Attachments in Web Map Popup - Page 9 - Esri Community

Re: Using Python to generate access token for an account that uses organization login

DCWORK_GIS — Tue, 05 Dec 2023 18:56:27 GMT

Hi Mark, would you mind sharing your method of accessing the token with a built-in user, not using user/pass. I had been accessing it using:

gis=GIS('home')
token=gis._con.token

but that code isn't working anymore, and I'm at a loss to find why, or a workaround.

Re: Using Python to generate access token for an account that uses organization login

MarkGambordella — Tue, 05 Dec 2023 19:27:13 GMT

I was able to find a work around for now. you cannot use your SAML account but instead have to create a built-in account. Use the built-in account for your user:password in the geoprocessing tool found in the link below. the tool creates a URL for only the first attachment (which is the only one I needed), the URL with a token is added to the attribute table. because the token expires, you can then run a script to update the token once a week. the links below were helpful in setting it up.

Show Attachments in Web Map Popup - Esri Community

Attachments to Popup - YouTube

Schedule a Python Script using Windows Task Scheduler - YouTube

Re: Using Python to generate access token for an account that uses organization login

DurmusCesar — Fri, 13 Feb 2026 13:03:20 GMT

Unless you use the built-in accounts only way to do this is to interactive login

https://community.esri.com/t5/arcgis-enterprise-questions/unable-to-generate-tokens-using-saml-enterprise/m-p/1055634#M30127

see excerpt below

User authentication with OAuth 2.0

The ArcGIS Python API supports OAuth 2.0 as an authentication method, and acts as a serverless native application when using OAuth 2.0 authorization with ArcGIS.

To use this mode of authorization, you need a client id. If you already have a client id, you can skip the following section.

Obtaining a client id

The steps below show how a client id can be obtained by registering a new application with your GIS. Only one client id is required, so if your GIS has one already, you may use it instead of creating a new application.

Log in to your ArcGIS Online or ArcGIS Enterprise organization.
Go to the Content tab.
Click 'New item', then select 'Application'.
On the 'New item' dialog, select 'Other application' and click 'Next'.
Type in a title for the application item. Optionally, specify the folder, tags, and summary.
Click 'Save' to add the item.
On the item details page of this newly created application, browse to the Credentials section and find the Client ID. The string listed is the value that you will pass in as the client_id parameter when creating the GIS object.

You can then log on to your org using the Python API using the code shown below:

Interactive Login Experience

This uses interactive sign-in experience: you would be redirected to your organization's sign-in page using the configured identity provider. Upon signing in, you would get a code that you can paste back to complete the sign-in process:

gis = GIS("https://pythonapi.playground.esri.com/portal", client_id='f8cRxbP3NO8bf9ag')
print("Successfully logged in as: " + gis.properties.user.username)

Please sign in to your GIS and paste the code that is obtained below.
If a web browser does not automatically open, please navigate to the URL below yourself instead.
Opening web browser to navigate to: https://pythonapi.playground.esri.com/portal/sharing/rest/oauth2/authorize?client_id=f8cRxbP3NO8bf9ag&response_type=code&expiration=-1&redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob
Enter code obtained on signing in using SAML: ········
Successfully logged in as: arcgis_python

Non-Interactive Login Experience

The recommended suggestion for non-interactive login scripts is to use the built-in identity provider instead of SAML.

Re: Using Python to generate access token for an account that uses organization login

DurmusCesar — Fri, 13 Feb 2026 13:04:56 GMT

Exactly or use interactive login with clientID (this works in case of SAML accounts)