Looking at the documentation for the Generate Token API https://developers.arcgis.com/rest/users-groups-and-items/generate-token.htm it seems to imply that when working with a Federated server one would want to generate the token for portal from the /generateToken endpoint. After that you would pass that token along with the serverName to a new request to /generateToken to obtain a token to use for accessing services
What is actually required to access a secure service on a federated server is to just call the /getToken method and passing in:
"client": "referer",
"referer": "https://anything/"
This does not make sense based on the documentation page, and the only way I figured it out was capturing traffic from a Runtime app and seeing what requests were being made
Thanks,
-Joe
