https://community.esri.com/t5/arcgis-rest-apis-and-services-questions/best-practices-for-authenticating-hosted-services/m-p/1289369#M4485 <P>I have a web app that uses esri-leaflet to let the user add map services from ArcGIS Online (or Portal) to a web map. It does this by first authenticating to get a token, querying the services that the user has access to, filtering out the Map Services/Map Image Layers, grabbing the `url` parameter and adding that to the map as a Dynamic Map Layer, using the token from the AGOL login.</P><P>Services can be added to AGOL with credentials embedded or not. When they are embedded, `url` parameter is an `arcgis.com` domain and the token I have from the authentication steps works (its an ArcGIS Online token authenticating an ArcGIS Online service - AGOL is doing some kind of proxy to the actual service in the background).</P><P>This brings me to my issue. If you do not embed credentials, the `url` parameter remains the same ('<A href="https://myorganization.com/arcgis/rest/services" target="_blank">https://myorganization.com/arcgis/rest/services</A>...`) and I SHOULD NOT be using my AGOL token for the requests. How do I know the difference between services where the credentials are embedded and I need to include my AGOL token and services where the credentials are not embedded and I need to go through another authentication step (or just don't include the AGOL token in cases of publicly shared services).</P><P data-unlink="true">The quick and simple answer seems to be to check if the URL is an `arcgis.com` domain but that seems imprecise. If Esri starts hosting its proxies under a different domain that logic stops working. None of the other parameters on the item itself in the REST API seem to indicate what I need. Is there an additional request I need to make? Playing with developer tools, I found a request to https://organization.maps.arcgis.com/sharing/rest/portals/isServerRegistered but I found no documentation on that endpoint. I'm really looking for the best practice for working with/authenticating these types of services.</P><P data-unlink="true">I didn't entirely mention it before but ideally the solution should work for both AGOL and Portal. Right now I'm just focusing on getting ArcGIS Online working though.</P><P data-unlink="true">Thanks in advanced!</P> Mon, 15 May 2023 21:39:30 GMT AndrewDunham1 2023-05-15T21:39:30Z https://community.esri.com/t5/arcgis-rest-apis-and-services-questions/best-practices-for-authenticating-hosted-services/m-p/1289369#M4485 <P>I have a web app that uses esri-leaflet to let the user add map services from ArcGIS Online (or Portal) to a web map. It does this by first authenticating to get a token, querying the services that the user has access to, filtering out the Map Services/Map Image Layers, grabbing the `url` parameter and adding that to the map as a Dynamic Map Layer, using the token from the AGOL login.</P><P>Services can be added to AGOL with credentials embedded or not. When they are embedded, `url` parameter is an `arcgis.com` domain and the token I have from the authentication steps works (its an ArcGIS Online token authenticating an ArcGIS Online service - AGOL is doing some kind of proxy to the actual service in the background).</P><P>This brings me to my issue. If you do not embed credentials, the `url` parameter remains the same ('<A href="https://myorganization.com/arcgis/rest/services" target="_blank">https://myorganization.com/arcgis/rest/services</A>...`) and I SHOULD NOT be using my AGOL token for the requests. How do I know the difference between services where the credentials are embedded and I need to include my AGOL token and services where the credentials are not embedded and I need to go through another authentication step (or just don't include the AGOL token in cases of publicly shared services).</P><P data-unlink="true">The quick and simple answer seems to be to check if the URL is an `arcgis.com` domain but that seems imprecise. If Esri starts hosting its proxies under a different domain that logic stops working. None of the other parameters on the item itself in the REST API seem to indicate what I need. Is there an additional request I need to make? Playing with developer tools, I found a request to https://organization.maps.arcgis.com/sharing/rest/portals/isServerRegistered but I found no documentation on that endpoint. I'm really looking for the best practice for working with/authenticating these types of services.</P><P data-unlink="true">I didn't entirely mention it before but ideally the solution should work for both AGOL and Portal. Right now I'm just focusing on getting ArcGIS Online working though.</P><P data-unlink="true">Thanks in advanced!</P> Mon, 15 May 2023 21:39:30 GMT https://community.esri.com/t5/arcgis-rest-apis-and-services-questions/best-practices-for-authenticating-hosted-services/m-p/1289369#M4485 AndrewDunham1 2023-05-15T21:39:30Z