Select to view content in your preferred language

Clarification About Licenses/API Key

355
5
Jump to solution
2 weeks ago
RTC
by
Regular Contributor

Our app has free and licensed users. For licensed users a named user license is used. For free users, we use a license string. With the free users using a license string we cannot load Esri basemaps without adding our API Key to the app. However, adding the API Key seems to also override a Name Users license so they cannot load there private secure maps. Our workaround is to remove the API Key once the user logs in but this is not ideal. Is there a better way to handle this?

Thanks!

0 Kudos
1 Solution

Accepted Solutions
Nicholas-Furness
Esri Regular Contributor

Hi.

This is likely not a licensing issue. API Keys don't impact licensing at all. They just provide access to services.

Here's what I think is happening:

I am taking a guess, but I expect that when you use an API Key, you are setting it globally on ArcGISEnvironment. When that happens, the SDK blindly uses that API Key across the board and doesn't even try the AuthenticationManager workflows, which are responsible for getting suitable access tokens for various services - in this case your logged-in user's access token via OAuth which will confer access to those web maps.

To use both API Keys and named user access tokens, one brute-force approach is what you're doing now - you unset that global API Key, and the SDK will then get a token for the user in question, which of course gives them access to their web maps.

A more refined approach might be to set the API Key specifically on the Basemap objects you create in code, and not at the global ArcGISEnvironment level. The key there is that Basemap implements APIKeyResource (scroll down to see which classes support this). Here's the full list of API classes that are APIKeyResources:

2025-09-18_12-08-09.png

This means you can specifically set an API Key on any of these, which will take precedence over any other token we might have (or try to get hold of) for that item through AuthenticationManager. If an API Key is NOT set, then the SDK will use AuthenticationManager. You could even use separate API Keys for RouteTask, LocatorTask, and Basemaps you create in code if you wanted, and the SDK will then fall back to AuthenticationManager for everything else.

In a little more detail… when determining which access token to use for a remote resource, the SDK follows this logic:

  1. Does the object (e.g. RouteTask) have an API Key set on it explicitly? If so, use that.
  2. If not, is there a global API Key set on ArcGISEnvironment? If so, use that.
  3. If not, let's ask AuthenticationManager for an access token (e.g. OAuth, or your custom authentication challenge handler, etc.).

Hope that helps.

P.S. When I talk about API Keys above, I mean in the context of Location Platform and ArcGIS Online; the Native Maps SDKs do not yet support ArcGIS Enterprise API Keys.

View solution in original post

0 Kudos
5 Replies
Nicholas-Furness
Esri Regular Contributor

Hi.

This is likely not a licensing issue. API Keys don't impact licensing at all. They just provide access to services.

Here's what I think is happening:

I am taking a guess, but I expect that when you use an API Key, you are setting it globally on ArcGISEnvironment. When that happens, the SDK blindly uses that API Key across the board and doesn't even try the AuthenticationManager workflows, which are responsible for getting suitable access tokens for various services - in this case your logged-in user's access token via OAuth which will confer access to those web maps.

To use both API Keys and named user access tokens, one brute-force approach is what you're doing now - you unset that global API Key, and the SDK will then get a token for the user in question, which of course gives them access to their web maps.

A more refined approach might be to set the API Key specifically on the Basemap objects you create in code, and not at the global ArcGISEnvironment level. The key there is that Basemap implements APIKeyResource (scroll down to see which classes support this). Here's the full list of API classes that are APIKeyResources:

2025-09-18_12-08-09.png

This means you can specifically set an API Key on any of these, which will take precedence over any other token we might have (or try to get hold of) for that item through AuthenticationManager. If an API Key is NOT set, then the SDK will use AuthenticationManager. You could even use separate API Keys for RouteTask, LocatorTask, and Basemaps you create in code if you wanted, and the SDK will then fall back to AuthenticationManager for everything else.

In a little more detail… when determining which access token to use for a remote resource, the SDK follows this logic:

  1. Does the object (e.g. RouteTask) have an API Key set on it explicitly? If so, use that.
  2. If not, is there a global API Key set on ArcGISEnvironment? If so, use that.
  3. If not, let's ask AuthenticationManager for an access token (e.g. OAuth, or your custom authentication challenge handler, etc.).

Hope that helps.

P.S. When I talk about API Keys above, I mean in the context of Location Platform and ArcGIS Online; the Native Maps SDKs do not yet support ArcGIS Enterprise API Keys.

0 Kudos
RTC
by
Regular Contributor

Thanks Nick!

RTC
by
Regular Contributor

Hi Nick,

Just re-read your P.S. part. Can you please expand on that?

I am developing for the Swift Native SDK. I noticed that if I try and create a new API key (not legacy) it give an error trying to load basemaps, no matter what I try, but the Legacy API key works just fine.

error with new API Key:

ArcGIS Maps SDK Invalid API Key Error: The API key '*****' is invalid, expired, or does not have access to the resource 'https://basemapstyles-api.arcgis.com/arcgis/rest/services/styles/v2/webmaps/arcgis/streets-relief '.

 

0 Kudos
Nicholas-Furness
Esri Regular Contributor

Hi @RTC 

The postscript is purely about the API Key capabilities introduced at ArcGIS Enterprise 11.4 (see link).

If you're seeing that an API Key is invalid, it means it's not scoped to access the services you're using it for. For basemaps, simply follow the instructions here.

API Keys can be created by either an ArcGIS Online account or an ArcGIS Location Platform account, but the important thing is to ensure that they're scoped for the service you want to access. Follow the instructions above to create an API Key and it should by default include Basemaps styles service access (which is what's needed for the service you're hitting.

2025-09-18_23-02-27.png

0 Kudos
RTC
by
Regular Contributor

Hi @Nicholas-Furness ,

Thanks for the clarification on the postscript!

Regarding the API key, I did follow the online instructions that you linked to when I originally create the key. I was able to get it to work this morning, I noticed that I had mistakenly added a referrer in the previous key.

Thanks!