I am having API Key Invalid issues

BraydenYancy

Hello, I have created a few things setup in the ArcGis Online, like a Webmap, Feature Layers on that, and an API key to access it.. Within my organization I have shared the webmap and feature layers to my organization. I then went into create item, API Key - selected 'view' content in general to give permission to view shared info in my organization, and then I even went in and selected items (My basemap and feature layer) that I wanted it to have access to...

I am just trying to test an index.html file with a script tag and hit my webmapID with my esriconfig api key and I keep getting 'invalid token' issues.. I have tried a dozen combinations at this point of regenerating the key, changing its access and permissions, secondary key, creating a new one etc.. though I cannot fix this issue. I even tested it against some public urls like:

'https://geocode-api.arcgis.com/arcgis/rest/services/World/GeocodeServer/findAddressCandidates?f=json... and appending my token to see, but I swear I had a working token a few days ago for a different test application and even tried testing that against my app and this public one but still keep getting that error..

Here is what my browser console is saying

------------------------------------------------------------------------------------------------------------------------------------
[@arcgis/core/WebMap] #load() Failed to load web map

o {type: 'error', name: 'webmap:load-portal-item', message: 'Failed to load portal item', details: {…}}

details:

error: o

details: {url: 'https://www.arcgis.com/sharing/rest/portals/self', requestOptions: {…}, ssl: false, getAllHeaders: ƒ, getHeader: ƒ, …}
message: "Invalid token."
name: "request:server"
type: "error"
[[Prototype]]: Object

[[Prototype]]: Object

message: "Failed to load portal item"
name: "webmap:load-portal-item"

type: "error"

Am I going crazy or is Esri API Token validating service/package down or messing up? Any help would be much appreciated, thanks.

George_Thompson

It is possible that it is related to this patch for Online, which was released earlier this week: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/april2026_security_bulletin

--- George T.

BraydenYancy

Oh man, hmm yeahhh it could have something to do with this.. I also found -

Limitations
Location services
ArcGIS Enterprise limitations: API key authentication cannot be used to access ArcGIS Location Services with ArcGIS Enterprise. However, API keys can still be used to access secure items in your Enterprise portal, such as locators (geocoding services) and hosted data services.

API key credentials
Creating credentials: There is no limit to the number of API key credentials and API keys you can create.

Accessing items: An API key credential can be configured to access a maximum of 100 items you own.

Viewing API keys: The value of an API key can only be viewed when the API key is first generated. After a key has been created, its full value is no longer accessible and is not stored in ArcGIS. If you lose the value of an API key, you have to invalidate it and generate a new key using the API key credentials item page.

Changing properties: Editing any of the privileges, item access privileges, or the expiration date of API key credentials will invalidate all API keys generated from that credential. New keys can be generated in the Settings section of the API key credentials item page.

Topic
To learn more, go to API Key Credentials.

API keys (legacy)
Attention
API keys (legacy) are being retired. All legacy API keys should be replaced with keys from API key credentials. To learn more, go to API key (legacy) retirement.

Prior to June 2024, API key authentication used API keys (legacy). These API keys still function, but can no longer be created or modified and will soon be retired. All new API keys must be created using API key credentials.

In the API Documentation.. I guess I'll need to gather more information and see whats up/happening because this definitely changes my current plan within my organization. Any more information that anyone has or can find would be greatly appreciated!

George_Thompson

I am not a developer, so unable to validate 😀

--- George T.

John-Foster

most likely your API key is not scoped to the complete set of services. you will need at least basemaps scope, if you are using geocoding you will need that privilege as well, and then you need to select all the items referenced by your web map and the web map item itself. You can see the referenced items on the items details page for your web map item under the Map section where it lists all the items used. In addition to the items listed there you also must add the web map to the api key.

--jf