400 Bad Request when Getting Token for client_credentials Request on Private Server

RockyCherry — Fri, 26 Sep 2025 22:29:57 GMT

Hello,

I have been using the ArcGis Online auth service with some web maps and now we're migrating to our own internal server. We're using client_credentials, so a typical URL would look like this:

https://www.arcgis.com/sharing/rest/oauth2/token?client_id=<clientId>&client_secret=<client_secret>&grant_type=client_credentials

On our server, the portal URL is https://our.internal.url.com/portal/. So, our auth URL should be (if I'm correct):

https://our.internal.url.com/portal/sharing/rest/oath2/token?client_id=<client_id>&client_secret=<client_secret>&grant_type=client_credentials.

However, when I hit that, I get 400 Bad Request with the message "Error: Invalid URL". What am I doing wrong? 400 Bad Request means it's able to access the URL, so I don't think it's an access or routing issue... but no clue what else to check or try.

Any ideas?

Re: 400 Bad Request when Getting Token for client_credentials Request on Private Server

HildermesJoséMedeirosFilho — Tue, 07 Oct 2025 12:20:18 GMT

https://developers.arcgis.com/documentation/security-and-authentication/reference/rest-authentication-operations/

I would double check if you mispelled something in the code, if you did you get 200, but a page...in html

You can pass format json to get the proper error code.

If I`m not mistaken the api is jsonp compliant unless turned off
https://developers.arcgis.com/rest/enterprise-administration/server/handlersrestservicesdirectoryedit/

topic Re: 400 Bad Request when Getting Token for client_credentials Request on Private Server in Developers Questions

400 Bad Request when Getting Token for client_credentials Request on Private Server

Re: 400 Bad Request when Getting Token for client_credentials Request on Private Server