RetroSearch Browse

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://developers.arcgis.com/documentation/security-and-authentication/types-of-authentication/ below:

Types of authentication | Documentation

This topic introduces the different types of authentication you can implement to get an access token. The type you choose depends on the type of application you are building, the types of resources you need to access, and the functionality you need to support in your application.

The three types of authentication are:

To compare the different types of authentication and see different use cases, go to Authentication comparision.

API key authentication

API key authentication is a type of authentication that uses a long-lived access token embedded directly into an application or console script. The access tokens are called API keys and are created and managed through API key credentials. The privileges of API key credentials can be configured to authorize API keys to access secure ArcGIS services and items.

API key authentication can be used to create public applications that access ArcGIS Location Services and secure content items. It can also be used to create personal scripts that perform spatial analysis and portal management operations.

API key authentication is the easiest type of authentication to set up and is recommended if you are new to ArcGIS.

Best practices

Implement API key authentication to:

Create public applications that do not require users to sign in.
Build applications that access ArcGIS Location Services and secure items such as hosted layers or data services.
Create personal automation scripts that access the portal service and spatial analysis services.
Quickly and easily generate access tokens for your applications.
Create long-lived access tokens that remain valid for up to one year.

Avoid using API key authentication to:

Provide a high level of security in public applications, as the access token is long-lived and can be scraped.
Access privileges with a personal scope in public applications.
Create private applications that require users to sign in.

Billing

All API key usage is billed to the ArcGIS subscription associated with the developer's account who created the key.

Learn more about API key authentication User authentication

User authentication is a set of authentication workflows that allows ArcGIS users to sign into an application and access secure resources. It requires that all users have an ArcGIS account. The authentication protocol used is OAuth 2.0. When a user signs into an application with their ArcGIS account, an access token is generated that authorizes the application to access services and content on their behalf. The resources and functionality available depend on the user type, roles, and privileges of the user's ArcGIS account. This authentication type was previously known as Named user login and ArcGIS identity.

User authentication generates a unique access token for each user that signs in to your application. Once a user authenticates, the app receives an access token with privileges identical to those of the signed-in user's account. This enables your application to access all content and services the user is authorized to.

Best practices

Implement user authentication to:

Create private applications that require users to sign in with an ArcGIS account.
Create apps that let members of your organization perform spatial analysis and portal management operations.
Access and manage secure items stored in a user's portal.
Meter usage of private and public data, content, or service transactions to the authenticated user.
Generate short-lived access tokens that are valid for a specified duration, and include a refresh token.

Avoid using user authentication to:

Create public applications that do not require a user to sign in.

Billing

Services an app accesses with user authentication will be billed to the ArcGIS account of the signed-in user.

Learn more about user authentication App authentication

App authentication is an authentication workflow that grants a short-lived access token via OAuth 2.0. App authentication provides access to similar resources and functionality as API key authentication. Typically, a server-side application component uses a set of OAuth credentials consisting of a client_id and client_secret to request an access token. The server-side component then passes the resulting access token to a client application.

App authentication can be used to create public applications with a server-side component that access ArcGIS Location Services and secure content items. It can also be used to create web servers or standalone console scripts that perform spatial analysis and portal management operations.

Best practices

Use app authentication to:

Create public applications that do not require users to sign in.
Build applications that access location services and private items such as hosted layers or data services.
Create web servers and automation scripts that access the portal service and spatial analysis services.
Authenticate with an OAuth 2.0 process that provides better security than API key authentication.
Use the privileges of your ArcGIS account to access secure resources.

Avoid using app authentication to:

Authenticate in public applications without a server-side component.
Access privileges with a personal scope in public applications.
Create private applications that require users to sign in.

Billing

Services an app accesses with app authentication will be billed to the developer's ArcGIS account.

Learn more about app authentication Authentication comparison

Below is a quick comparison of the application type, billing method, privileges, and access token storage and duration for the different types of authentication.

API key authentication User authentication App authentication Application type Public (no sign in required) Private (sign in required) Public (no sign in required) Billing Usage billed to your ArcGIS subscription. Usage billed to the signed-in user's ArcGIS subscription. Usage billed to your ArcGIS subscription. Access token privileges Determined by the properties of the developer credentials. Determined by privileges of the signed-in user's account. Determined by the properties of the developer credentials. Access token storage Static, embedded in the application. New token created for every signed-in user. Created upon request and stored in the application. Access token duration Up to 1 year. Up to 2 weeks, can be refreshed. 2 weeks. Resources and functionality

The following table provides an overview of the functionality available with each type of authentication:

API key authentication User authentication App authentication ArcGIS Location Services ¹ ¹ ¹ Data services (Item access) Spatial analysis services ¹ ¹ Portal service (General privileges) Portal service (Admin privileges) Full support Partial support No support API support

The following table shows the level of API support for each type of authentication:

Full support Partial support No support Choosing a type of authentication

Answer the following questions to help choose the best type of authentication to implement for the custom application you are building:

What is the target audience of your of app?
- Public application (no sign in required): API key authentication or app authentication.
- Private application (ArcGIS sign in required): User authentication.
What type of ArcGIS product and account do you have?
- ArcGIS Location Platform: Typically API key authentication or app authentication.
- ArcGIS Online: Typically user authentication, but can implement all types of authentication.
- ArcGIS Enterprise: Typically user authentication, but can implement all types of authentication.
Which do you value more, simple implementation or higher security?
- Simple implementation: API key authentication.
- Higher security: User authentication or app authentication.
What agent will request an access token?
- Client-side app or web app: API key authentication or user authentication with a PKCE flow.
- Server: App authentication or user authentication with an Authorization code flow.
- Console script: App authentication.

The following table provides use cases for each type of authentication:

Use case Solution You are building a public application that requires access to location services. API key authentication or app authentication You are building a private application intended for members of your organization User authentication You are building an application on a server or API back-end that will not be seen by users. API key authentication or app authentication You are building an application that will read private hosted data on your ArcGIS account. API key authentication or app authentication You are building an application that will read private hosted data from the ArcGIS accounts of organization members. User authentication You are building a personal automation script to perform tasks with the portal service or spatial analysis services. API key authentication You are building an application that enables users to perform management tasks with the portal service User authentication You are building an application that enables users to perform spatial analysis. User authentication You are building an application using an ArcGIS API. API key authentication, app authentication, or user authentication

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4