App Development Considerations

Before you start building apps, you need to decide who will use your app, which ArcGIS resources your app needs, and the type of authentication to use. These decisions will influence your app's security and development workflow.

Use this page to help guide your decisions on choosing an:

• Authentication strategy
• SDK when building an application

Choose a type of authentication

Every ArcGIS Location PlatformArcGIS Location Platform, formerly known as ArcGIS Platform, is a Platform as a Service (PaaS) product that gives developers access to location services, APIs, and tools to build mapping and spatial analysis applications. It is subscription-based and requires an ArcGIS Location Platform account.Learn more application requires an authentication strategy. The correct approach depends on who uses your application and what resources it needs to access.

API key authentication

API keysAn API key is a long-lived access token created using API key credentials. They are valid for up to one year and are typically embedded directly into client applications.Learn more authenticate the application access to ArcGIS services, not the user. Use API keys when users do not need to sign in and all users can access the same ArcGIS Location ServicesArcGIS Location Services, also referred to as Location Services, are services hosted by Esri that provide geospatial functionality for developing mapping applications. They include the ArcGIS Basemap Styles service, ArcGIS Static Basemap Tiles service, ArcGIS Static Maps service, ArcGIS Places service, ArcGIS Geocoding service, ArcGIS Routing service, ArcGIS GeoEnrichment service, and ArcGIS Elevation service. An ArcGIS Location Platform or ArcGIS Online account is required to use the services.Learn more.

Use API key authentication when your application:

• Accesses ArcGIS Location ServicesArcGIS Location Services, also referred to as Location Services, are services hosted by Esri that provide geospatial functionality for developing mapping applications. They include the ArcGIS Basemap Styles service, ArcGIS Static Basemap Tiles service, ArcGIS Static Maps service, ArcGIS Places service, ArcGIS Geocoding service, ArcGIS Routing service, ArcGIS GeoEnrichment service, and ArcGIS Elevation service. An ArcGIS Location Platform or ArcGIS Online account is required to use the services.Learn more without user sign-in.
• Uses a simple, application-based authentication model.
• Query and edit data in your portal without requiring user sign-in.
• Runs entirely in the client.

User authentication

Use user authenticationUser authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth2.0.Learn more when the application needs to sign users in or act on their behalf. This is usually the right choice when:

• Users must sign in.
• Applications access content on behalf of users.
• User-specific permissions are required.
• Applications access private organizational content.

App authentication

App authenticationApp authentication is a type of authentication that grants a short-lived access token based on an OAuth 2.0 client ID and client secret, authorizing an application to access ArcGIS services and items.Learn more uses OAuth 2.0 client credentials to obtain a short-lived access token for an application. A server-side component uses a client ID and client secret to request the token, then uses it to access resources with the privileges of the account that owns the OAuth credentials.

Use app authentication when your application:

• Has a server-side component.
• Does not require users to sign in.
• Needs stronger security than a long-lived API key.
• Accesses ArcGIS Location ServicesArcGIS Location Services, also referred to as Location Services, are services hosted by Esri that provide geospatial functionality for developing mapping applications. They include the ArcGIS Basemap Styles service, ArcGIS Static Basemap Tiles service, ArcGIS Static Maps service, ArcGIS Places service, ArcGIS Geocoding service, ArcGIS Routing service, ArcGIS GeoEnrichment service, and ArcGIS Elevation service. An ArcGIS Location Platform or ArcGIS Online account is required to use the services.Learn more or private items that are not sensitive or confidential.

Decision guidance

Use the table below as a quick guide to choose the appropriate type of authentication based on application requirements.

Which SDK should I use?

ArcGIS Location Platform supports a wide range of applications, including web, mobile, desktop, AR/VR/XR, and backend services, through various SDKs and APIs. Use the table below to choose the ArcGIS SDK or API based on your application requirements.

FAQ

Is authentication required when consuming ArcGIS location services?
Yes. ArcGIS location service endpoints require a valid access token, such as an API key, app authentication token, or OAuth access token.

How do I choose between API key and OAuth?
Use API keys or app authentication for app-level access patterns. Use OAuth user authentication when your app needs user identity, or user-specific permissions.

Related resources