Questions regarding apiKey usage on layers loaded from AGOL and requests to utility.arcgis.com

EmilAura

Hi,

I am having some trouble with the authentication of a layer loaded from a Portal item when using the ArcGIS Maps SDK for JavaScript. I was hoping you could clarify if I’m missing a configuration step or if I’ve encountered a known behaviour.

The Scenario: I am loading a specific layer from a Portal item and providing an apiKey directly in the portalItem configuration:

const layer = await Layer.fromPortalItem({
  portalItem: {
    id: "MY_LAYERS_PORTAL_ID",
    apiKey: "MY_SPECIFIC_API_KEY"
  }
});

In my application, I also use a global request interceptor that manages dynamic tokens for other general services by updating esriConfig.apiKey.

esriConfig.request.interceptors.unshift({
  async before() {
    esriConfig.apiKey = await getEsriToken();
  }
  urls: [
    'https://www.arcgis.com',
    'https://snla.maps.arcgis.com',
    'https://services-eu1.arcgis.com',
    'https://utility.arcgis.com',
    'https://services-eu1.arcgis.com',
    'https://elevation.arcgis.com',
    'https://route-api.arcgis.com',
    'https://geocode.arcgis.com'
  ]
});

The Problem: I've noticed that while the initial portal metadata requests (sharing/rest) correctly use the provided apiKey, the subsequent request for the layer data (routed through the utility service proxy) behaves differently:

URL: https://utility.arcgis.com/usrsvcs/servers/PORTAL_ID/rest/services/SERVICE_NAME/FeatureServer/0 Uses the key from esriConfig.apiKey
Observation: If I remove the utility.arcgis.com domain from my global interceptor, this request triggers an ArcGIS login prompt, suggesting it isn't using the apiKey I provided to the layer.
Conflict: If my global interceptor is active, the request uses the global esriConfig.apiKey instead of the layer-specific one, which causes an authentication failure for this private layer.

My Questions:

Should requests routed through utility.arcgis.com automatically inherit the apiKey provided to the PortalItem or Layer?
Am I doing something wrong in how I'm passing the key? I tried setting the apiKey on the resulting layer instance or the portal object as well, without success.
Is there a recommended pattern for maintaining a global API key while allowing certain layers to use their own specific keys for proxied services?

Best Regards,

Emil Aura