topic Re: {error: {code: 498, message: "Token Invalid.", ...} in Developers Questions

{error: {code: 498, message: "Token Invalid.", ...}

FarrukhZahid — Tue, 11 Mar 2025 12:30:30 GMT

HI,

I am currently using ArcGIS Enterprise 11.4 (Portal-Federated Server) with a developer account subscription. When generating a simple basic API key, I repeatedly encounter a white screen. Checking the network reveals error 498. I have attempted this in different environments, yet the issue persists. Although my environment is secured, I am facing this problem on my local machine (Secured Environment) where the portal is installed. Each time, the key appears as an invalid token.

{
"error": {
"code": 498,
"message": "Token Invalid.",
"details": [
"The required authentication information is invalid. The token is either invalid or has expired."
],

Re: {error: {code: 498, message: "Token Invalid.", ...}

JoshuaBixby — Tue, 11 Mar 2025 13:09:42 GMT

If the software is consistently telling you the token is invalid, there is likely something wrong with either the credentials or how the token is being generated. Unless you provide more information about how you setup the "simple basic API key" and how exactly you are using the key to generate a token, there isn't much for anyone to comment on here.

Re: {error: {code: 498, message: "Token Invalid.", ...}

FarrukhZahid — Tue, 11 Mar 2025 13:51:26 GMT

I am following this link for API key generation "https://developers.arcgis.com/documentation/security-and-authentication/api-key-authentication/tutorials/create-an-api-key/"

and to test my API key, I am using this simple base map "https://developers.arcgis.com/javascript/latest/tutorials/change-the-basemap-style/"

Re: {error: {code: 498, message: "Token Invalid.", ...}

LaurenBoyd — Wed, 12 Mar 2025 15:41:15 GMT

Hi @FarrukhZahid -

The JavaScript Maps SDK currently only supports using API keys with ArcGIS Online and ArcGIS Location Platform users as outlined here: https://developers.arcgis.com/javascript/latest/secure-resources/#api-keys

API keys generated with an ArcGIS Enterprise user is planned to be supported at the next release (version 4.33). In the meantime, you could utilize RequestInterceptor to append the API key generated with your Enterprise account as the token parameter to all requests before the request is sent to the basemap service.

Re: {error: {code: 498, message: "Token Invalid.", ...}

John-Foster — Mon, 17 Mar 2025 19:04:45 GMT

@FarrukhZahidan api key generated on ArcGIS Enterprise can only authorize services on that Enterprise instance, so if you are using a key generated on ArcGIS Enterprise to authorize services on ArcGIS Online then you will expect to see error 498 Invalid Token. You will need to log in with an ArcGIS Online account and generate and API key there in order to authorize services from ArcGIS Online.

Re: {error: {code: 498, message: "Token Invalid.", ...}

TimWestern — Tue, 18 Mar 2025 18:45:12 GMT

I'm curious, You mentioned a Portal Federated Server (For these dashboards are users logging in through that federation? If so I'm wondering why an APIKey vs an OAuth2 key is preferred here for your purposes.

Re: {error: {code: 498, message: "Token Invalid.", ...}

DeanWilson — Wed, 14 May 2025 14:14:32 GMT

Hi @LaurenBoyd and @John-Foster ,

I've been having similar issues to @FarrukhZahid as far as using API keys. The documentation you linked was the first time I seen that note, because all of the docs I've been going through kept mentioning that you get api key auth if you're using enterprise server 11.4. Since the Maps SDK, at least per that obscure note that I wouldn't have looked for in the Arcgis Portal section of the Maps sdk, doesn't allow auth via api keys yet, does that include Experience Builder as well?

I was hoping this was the fix for my portal sharing problem where I have secure services built in the portal, and when I try to access popups publicly, it asks for a login.

Sorry if that sounds curt, I've been going rounds with these auth issues for awhile.

Thanks in advance!

Re: {error: {code: 498, message: "Token Invalid.", ...}

John-Foster — Wed, 14 May 2025 23:13:06 GMT

@TimWesternthe use case for the API key would be when the end user does not have an ArcGIS account to authenticate or the app does not want to prompt a user to log in to authenticate access with the services so the api key access token is used. OAuth will require a user to log in to generate the access token.

Re: {error: {code: 498, message: "Token Invalid.", ...}

John-Foster — Wed, 14 May 2025 23:16:30 GMT

@DeanWilsoncurrently ArcGIS Experience Builder does not support API key authentication

Re: {error: {code: 498, message: "Token Invalid.", ...}

TimWestern — Fri, 16 May 2025 12:54:01 GMT

That's a very clear explanation, @John-Foster, Thank you.

Re: {error: {code: 498, message: "Token Invalid.", ...}

TimWestern — Fri, 16 May 2025 12:54:55 GMT

So that means not even a pre-setup API Key perhaps stored in an environment variable is a no go?

(As opposed to passing it as a token in a url, since EXB does not yet honor a lot of the url parameters that WebAppBuilder might have?)

Re: {error: {code: 498, message: "Token Invalid.", ...}

LaurenBoyd — Thu, 10 Jul 2025 22:07:34 GMT

Hi @DeanWilson & @FarrukhZahid -

Good news! Using API keys to access ArcGIS Enterprise secure services with the JS Maps SDK is supported at version 4.33. You can set the API key directly on the layer class or set a globally configured API key. Check out the API key authentication documentation and the release notes for more details.

Hope this helps!

Re: {error: {code: 498, message: "Token Invalid.", ...}

DeanWilson — Fri, 11 Jul 2025 12:08:08 GMT

Hi @LaurenBoyd

I did indeed get API keys working with a testing web application using some of the web components which was nice. One thing I wouldn't mind seeing in the documentation is how to use said API keys using an application built via Experience Builder Developer edition. We use a local enterprise portal and not AGO. Can you or anyone direct me to said documentation?

Thanks in advance!

Dean

Re: {error: {code: 498, message: "Token Invalid.", ...}

John-Foster — Fri, 11 Jul 2025 15:31:07 GMT

Experience Builder does not yet support API key authentication. Please put a comment in their Ideas channel to request this feature - https://community.esri.com/t5/arcgis-experience-builder-ideas/idb-p/arcgis-experience-builder-ideas

Re: {error: {code: 498, message: "Token Invalid.", ...}

TimWestern — Mon, 14 Jul 2025 12:37:17 GMT

@John Google search might be confusing people on this matter, I tried a search:

arcgis experience builder API Key authentication and it's AI spit out this:

one of the links went here: https://developers.arcgis.com/documentation/security-and-authentication/types-of-authentication/#:~:text=API%20key%20authentication%20is%20a,you%20are%20new%20to%20ArcGIS.&text=Implement%20API%20key%20authentication%20to,for%20up%20to%20one%20year. But it does not mention EXB just AGOL and AGE, and a bunch of program language APIs. There is nothing in that documentation to alert folks that Experience Builder does not currently have this capability, but multiple other products do, unfortunately, that doesn't help those who need that feature

@DeanWilson Unfortunately, I believe John-Foster is correct that EXB does not currently support API Keys. It can be suggested at: https://community.esri.com/t5/arcgis-experience-builder-ideas/idb-p/arcgis-experience-builder-ideas

Re: {error: {code: 498, message: "Token Invalid.", ...}

DeanWilson — Mon, 14 Jul 2025 14:58:49 GMT

@John-Foster and @TimWestern ,

Thanks for the information on this. I've been trying my best to utilize the new tooling that we're being given by ESRI but it's not working out. We may be sticking with Web Appbuilder for awhile longer I think.