Hi,
I am having some trouble with the authentication of a layer loaded from a Portal item when using the ArcGIS Maps SDK for JavaScript. I was hoping you could clarify if I’m missing a configuration step or if I’ve encountered a known behaviour.
The Scenario: I am loading a specific layer from a Portal item and providing an apiKey directly in the portalItem configuration:
const layer = await Layer.fromPortalItem({
portalItem: {
id: "MY_LAYERS_PORTAL_ID",
apiKey: "MY_SPECIFIC_API_KEY"
}
});
In my application, I also use a global request interceptor that manages dynamic tokens for other general services by updating esriConfig.apiKey.
esriConfig.request.interceptors.unshift({
async before() {
esriConfig.apiKey = await getEsriToken();
}
urls: [
'https://www.arcgis.com',
'https://snla.maps.arcgis.com',
'https://services-eu1.arcgis.com',
'https://utility.arcgis.com',
'https://services-eu1.arcgis.com',
'https://elevation.arcgis.com',
'https://route-api.arcgis.com',
'https://geocode.arcgis.com'
]
});
The Problem: I've noticed that while the initial portal metadata requests (sharing/rest) correctly use the provided apiKey, the subsequent request for the layer data (routed through the utility service proxy) behaves differently:
- URL: https://utility.arcgis.com/usrsvcs/servers/PORTAL_ID/rest/services/SERVICE_NAME/FeatureServer/0 Uses the key from esriConfig.apiKey
- Observation: If I remove the utility.arcgis.com domain from my global interceptor, this request triggers an ArcGIS login prompt, suggesting it isn't using the apiKey I provided to the layer.
- Conflict: If my global interceptor is active, the request uses the global esriConfig.apiKey instead of the layer-specific one, which causes an authentication failure for this private layer.
My Questions:
- Should requests routed through utility.arcgis.com automatically inherit the apiKey provided to the PortalItem or Layer?
- Am I doing something wrong in how I'm passing the key? I tried setting the apiKey on the resulting layer instance or the portal object as well, without success.
- Is there a recommended pattern for maintaining a global API key while allowing certain layers to use their own specific keys for proxied services?
Best Regards,
Emil Aura
