I've been struggling to find documentation for my exact use case, and I was hoping someone here can point me in the right direction. I have a feature layer (which is not shared publicly) in ArcGIS Online, which I want to share with a client so that it can be displayed and queried on a map within their application. The client's application is not public, and is secured using their own authentication. They do not want the users of their app to see a second ArcGIS username & password prompt when the map loads the layer, nor do I want to provide them with a user name and password for our AGOL organizational account. I want to provide them with an API key, OAuth credentials, or implement some other authentication scheme so that their developers can add a map to their app, using the ArcGIS JavaScript SDK, which shows the layer I want to share with them, allowing the developers to handle authentication without any need for username and password input from the user. I have been reading through the ArcGIS documentation on authentication for OAuth2 and API keys, but I can't seem to find anything pertaining to this exact workflow. Is this even possible? If so, is anyone aware of relevant documentation from Esri on how to do this?
Hi mfcallahan, Sounds like either API Key or App authentication would work in this situation. Both types of authentication would require you to create developer credentials in your portal, you would then share either the API Key or App credential id & secret with your client to implement on their side. Here's some examples to get you started...
@mfcallahanalso check this response when using ArcGIS Online and API keys: https://community.esri.com/t5/developers-questions/how-do-i-create-an-api-key/m-p/1592371/highlight/...
Thanks for the replies - API key authentication worked out best for me. I didn't initially see this, only the option for OAuth when creating new developer credentials, as the account under which the data was owned didn't have proper permissions to select API key. Moving the data to a different account enabled that, and I was able to successfully create and use an API key, and provided that to the client.