Failed to load public ESRI layer when referrer is set

[ranico]

Hi all, I've been using ESRI's USA Census Tracts layer for lots of my applications (it's public and hosted by esri, not me): https://services.arcgis.com/P3ePLMYs2RVChkJx/arcgis/rest/services/USA_Census_Tracts/FeatureServer.

It's been loading fine in my apps until I added a referrer to the api key (so the api calls are restricted to my company's hosting server / can't be used elsewhere). When I set this, the layer now fails to load and gives me some error codes and messages:

• httpStatus: 498
• messages: Invalid token.

I've tried loading it with the new api key assigned in the feature layer token property and without assigning it - the same error happens. Can someone explain why this might be happening? I have a feeling it might have to do with setting the content item scopes but since this is external data, it's not really something I can set and I don't know a way around this.

Any advice is appreciated :).

[ranico]

I think the issue has to do with me assigning the restricted api key to the esri config variable:

esriConfig.apiKey = 'PRIVATEAPI';

This is because when I check the api request being made when the page loads, it's automatically assigning the private api key as a token for this layer:

I don't want to copy and paste the specific request here because it contains the api key, but I think I just need the request to be made without a token assigned. One other option is creating two api keys - a restricted one and non-restricted one to assign instead but I really don't want to host a public api key for security reasons. I'd rather just have no key be passed at all for this later since it's a publicly hosted layer. Is this possible?