How to create API Key properly as a token, to create shareable layer service url

[MichaelLev]

From my ArcGIS Online account, I need to share my private layer with a customer in a simple way, so he'd be able to add it to his scene, and hence, to his web application.

I found an article from Sep 15, 2023 "Leveraging API Keys for Un-Credentialed Access to Hosted Layers" referring exactly that issue. It explains that by appending the API key as a token to the private layer url, thus: <layer service url>?token=<api key>, we have created a "shareable url", that can be used by the customer as if the layer was public.

The article speaks about "set up your scope", but I have not succeeded to see and understand what it meant...

In my api key "Edit Item access" I enabled the layer and its service url, and I even have set the referrer to the domain of the layer service url, hoping that this is what was meant by "set up your scope".

But when setting it as an address in chrome, I got an err msg: "invalid token", even without requesting username and password, as in the article's example.

I suspect that I have not yet succeeded to define the API Key exactly as needed, but I don't know what is the error and how to fix it. I hope an elaborated example and some explanation could help.

I attach screenshot of that API Key privileges, referrers and Item access

[ChrisLandvogt]

Hi @MichaelLev - I wrote that blog. Since it was published, the capability is out of beta and the Esri documentation Introduction to API key authentication | Documentation | Esri Developer (arcgis.com)  and API key credentials | Documentation | Esri Developer (arcgis.com) has been expanded significantly. I would suggest you refer to those pages for the new process. Hope this helps (I will retire the blog to avoid any confusion). - Chris

[MichaelLev]

@ChrisLandvogt , I appreciate your fast responding. I have read those links.

You had put the "shareable url" as address in the browser, so there is no "referrer domain". Yet it worked for you then. For me now, putting the "shareable url" as a browser address does not work.

The API Key works for me now by adding that private layer to a scene in my ArcGIS Online account, and then running that scene in a web app on a domain which has previously been added to the API Key's "referrers list".

I wonder whether the private layer could be added to a scene on another portal and be run on another domain (which I would add to the API Key "referrers list").

I also wonder if "shareable url" would be usable in ANY way at all...

I will appreciate it very much if you try and tell me whether the "shareable url" could be useful at all in any ways.

Anyway, I would appreciate it very much if I know that the "shareable url" indeed works for you in the browser also in these days, as it worked for you when you wrote that blog.

[ChrisLandvogt · Accepted solution]

Hi @MichaelLev I just tested it with a tile layer in ArcGIS Online. (no referrer domain in the API key, I just added the items I wanted it to link to)

e.g. https://tiles.arcgis.com/tiles/vHnIGBHHqDRy0CR/arcgis/rest/services/Test_WTL1/MapServer (just an exa...

Append the API key 

https://tiles.arcgis.com/tiles/vHnIGBHHqDRy0CR/arcgis/rest/services/Test_WTL1/MapServer?token=your_token_here

Open in incognito and it works. I'm not sure that I understand the remainder of the question. I'm happy to try to help, but your local Esri support may be able to investigate also, 

Hope this helps. 

Regards, Chris

[MichaelLev · Accepted solution]

Thank you again, @ChrisLandvogt , indeed if I left referrers empty and enabled the service and the layer in the API Key and opened incognito, the shared url worked to show the json.

But if I try to add the shared url to a scene in another ArcGIS Online, I can't...

Maybe you can enlighten my eyes also in this aspect - how to add the shared url to a scene in another portal?

[ChrisLandvogt · Accepted solution]

No problems @MichaelLev - I have found the same, in my other organisation, the token is not accepted (even when added manually as parameters) and it attempts to authenticate using credentials rather than the API key. For this - I would recommend you create a support case to get clarity on whether this is a supported workflow. The typical method would be to share the layer across the organisations through groups, a partnered/distributed collaboration, or embedding credentials  (depending if ArcGIS Online or Enterprise. Good luck with the support case - I encourage you to post how you go here for the benefit of the broader Esri community. Cheers - Chris