I have a web app that uses esri-leaflet to let the user add map services from ArcGIS Online (or Portal) to a web map. It does this by first authenticating to get a token, querying the services that the user has access to, filtering out the Map Services/Map Image Layers, grabbing the `url` parameter and adding that to the map as a Dynamic Map Layer, using the token from the AGOL login.
Services can be added to AGOL with credentials embedded or not. When they are embedded, `url` parameter is an `arcgis.com` domain and the token I have from the authentication steps works (its an ArcGIS Online token authenticating an ArcGIS Online service - AGOL is doing some kind of proxy to the actual service in the background).
This brings me to my issue. If you do not embed credentials, the `url` parameter remains the same ('https://myorganization.com/arcgis/rest/services...`) and I SHOULD NOT be using my AGOL token for the requests. How do I know the difference between services where the credentials are embedded and I need to include my AGOL token and services where the credentials are not embedded and I need to go through another authentication step (or just don't include the AGOL token in cases of publicly shared services).
The quick and simple answer seems to be to check if the URL is an `arcgis.com` domain but that seems imprecise. If Esri starts hosting its proxies under a different domain that logic stops working. None of the other parameters on the item itself in the REST API seem to indicate what I need. Is there an additional request I need to make? Playing with developer tools, I found a request to https://organization.maps.arcgis.com/sharing/rest/portals/isServerRegistered but I found no documentation on that endpoint. I'm really looking for the best practice for working with/authenticating these types of services.
I didn't entirely mention it before but ideally the solution should work for both AGOL and Portal. Right now I'm just focusing on getting ArcGIS Online working though.
Thanks in advanced!
