Deployment and authentication patterns

Deployment and security requirements depend on the type of application you build and the APIsA Client API is a web, native, or scripting Application Programming Interface (including all ArcGIS, open source, and third-party APIs) that has mapping capabilities and can be used to access ArcGIS location services.Learn more or SDKs you use. ArcGIS Location PlatformArcGIS Location Platform, formerly known as ArcGIS Platform, is a Platform as a Service (PaaS) product that gives developers access to location services, APIs, and tools to build mapping and spatial analysis applications. It is subscription-based and requires an ArcGIS Location Platform account.Learn more supports deployment for web, native, game engine, and service-based applications, with multiple authentication strategies based on audience and data access needs.

Use this topic to plan and review deployment and authentication for your application:

• Deployment patterns for your application type.
• Deployment support capabilities for your subscription.
• Authentication requirements for your application type.
• Operational readiness requirements for your application.
• Compliance and attribution requirements for your application.

Architecture pattern

The sections below describe common deployment patterns for applications built with ArcGIS Location Platform. Each pattern includes prerequisites and typical use cases.

Web applications

Most ArcGIS web applications use ArcGIS Maps SDK for JavaScript. You can also use open-source mapping libraries that consume ArcGIS location servicesArcGIS Location Services, also referred to as Location Services, are services hosted by Esri that provide geospatial functionality for developing mapping applications. They include the ArcGIS Basemap Styles service, ArcGIS Static Basemap Tiles service, ArcGIS Static Maps service, ArcGIS Places service, ArcGIS Geocoding service, ArcGIS Routing service, ArcGIS GeoEnrichment service, and ArcGIS Elevation service. An ArcGIS Location Platform or ArcGIS Online account is required to use the services.Learn more.

Prerequisites

To build and deploy a web application using ArcGIS Location Platform, you need:

• An ArcGIS Location Platform accountAn ArcGIS Location Platform account, formerly known as an ArcGIS Developer account, is an identity associated with an ArcGIS Location Platform subscription.Learn more
• Review and agree to the Terms of Use

Common use cases

Web applications are a good fit when your app runs in a browser and is distributed through URLs or web hosting platforms. Examples include:

• Client-side, static, and single-page applications
• Dynamic web applications with front-end and back-end technologies
• Progressive web apps (PWAs)
• Rich internet applications (RIAs)
• Browser and IDE extensions

Native applications

Native applications typically use ArcGIS Maps SDKs for Native Apps and are deployed to desktops, mobile devices, or embedded systems.

Prerequisites

To build and deploy a native application, you need:

• An ArcGIS Location Platform accountAn ArcGIS Location Platform account, formerly known as an ArcGIS Developer account, is an identity associated with an ArcGIS Location Platform subscription.Learn more
• Review and agree to the Terms of Use
• An ArcGIS Runtime license stringA license string is a string of characters developers add to their application code to license their use of applications built with ArcGIS Maps SDKs for Native Apps and to unlock certain capabilities on the deployment device.Learn more or user authentication

Common use cases

Native applications are best fit when your application needs direct OS integration, device-specific capabilities, or packaged distribution through app stores or installers. Examples include:

• Mobile apps for phones and tablets
• Desktop apps for Linux, macOS, or Windows
• Smart device apps
• Embedded applications

Game engine apps

Game engine apps typically use ArcGIS Maps SDKs for game engines and deploy to supported devices, operating systems, or embedded systems.

Prerequisites

To build and deploy a game engine application, you need:

• An ArcGIS Location Platform account
• Agreement to the Terms of Use
• Review of the deployment guidance for your SDK

Common use cases

Game engine applications are a good fit for immersive 3D, simulation, or XR experiences built on a game engine runtime. Examples include:

• Applications for Android or iOS phones and tablets
• Standalone Windows applications
• macOS applications
• AR and VR applications for XR platforms

Service-based apps

Service-based apps run in server or automation environments and call ArcGIS location services through APIs and libraries. Common options include ArcGIS REST API, ArcGIS REST JS, ArcGIS Maps SDK for JavaScript in Node.js, ArcGIS Maps SDK for .NET and ArcGIS API for Python.

Prerequisites

To build and deploy a service-based app, you need:

• An ArcGIS Location Platform account
• Agreement to the Terms of Use

Common use cases

Service-based apps are a good fit when your app runs as a back-end service, scheduled process, webhook workflow, or machine-to-machine integration. Examples include:

• Web services
• REST applications
• Scripting applications
• Internal libraries
• Developer APIs
• Machine-to-machine processes

Deployment support capabilities

The following table summarizes the types of deployment opportunities supported by an ArcGIS Location Platform subscription.

	ArcGIS Location Platform subscription
Build and deploy private applicationsA private application is an application that requires users to sign in with an ArcGIS account. It supports user authentication.Learn more
Build and deploy public applicationsA public application is an application that allows anonymous access without requiring users to sign in with an ArcGIS account. It supports API key or app authentication.Learn more
Build and deploy non-commercial applications
Build and deploy commercial applications
Build web and native applications with ArcGIS and open source APIs
Build and deploy applications that access private content in ArcGIS
Distribute applications through app stores
Build and deploy applications with offline capability	1

• 1. Contact Esri sales.

Authentication requirements

Applications that use ArcGIS location servicesArcGIS Location Services, also referred to as Location Services, are services hosted by Esri that provide geospatial functionality for developing mapping applications. They include the ArcGIS Basemap Styles service, ArcGIS Static Basemap Tiles service, ArcGIS Static Maps service, ArcGIS Places service, ArcGIS Geocoding service, ArcGIS Routing service, ArcGIS GeoEnrichment service, and ArcGIS Elevation service. An ArcGIS Location Platform or ArcGIS Online account is required to use the services.Learn more must authenticate with a valid access token. Your method should be based on anonymous access requirements, user sign-in requirements, and whether the app must access private ArcGIS content.

After selecting a deployment pattern, choose authentication based on audience type and data access requirements.

In this section, application types refer to security audience and sharing model (public, private, or personal). This is separate from deployment architecture guidance (web, native, game engine, or service-based) above.

Supported authentication methods include:

• API keyAn API key is a long-lived access token created using API key credentials. They are valid for up to one year and are typically embedded directly into client applications.Learn more
• App authenticationApp authentication is a type of authentication that grants a short-lived access token based on an OAuth 2.0 client ID and client secret, authorizing an application to access ArcGIS services and items.Learn more
• OAuth 2.0OAuth 2.0 is an industry standard protocol for authorization. It defines how to obtain and manage credentials for web, desktop, and mobile applications. It is supported by ArcGIS.Learn more user authenticationUser authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth2.0.Learn more

Choose an authentication method

Use the following table to identify a recommended authentication method.

Application audience types

The type of app you build is defined by its sharing level and target audience. The table below helps determine the authentication method you should use and the secure resources your app can access.

Operational readiness

When you build and deploy applications with ArcGIS Location Platform, plan for billing to avoid service interruptions. Each ArcGIS Location Platform accountAn ArcGIS Location Platform account, formerly known as an ArcGIS Developer account, is an identity associated with an ArcGIS Location Platform subscription.Learn more includes:

• A free tier for select location servicesArcGIS Location Services, also referred to as Location Services, are services hosted by Esri that provide geospatial functionality for developing mapping applications. They include the ArcGIS Basemap Styles service, ArcGIS Static Basemap Tiles service, ArcGIS Static Maps service, ArcGIS Places service, ArcGIS Geocoding service, ArcGIS Routing service, ArcGIS GeoEnrichment service, and ArcGIS Elevation service. An ArcGIS Location Platform or ArcGIS Online account is required to use the services.Learn more
• Pay-as-you-goPay-as-you-go is a payment option in ArcGIS Location Platform that allows you to exceed the free usage tier and pay for additional location services and capabilities based on usage.Learn more disabled by default

You can build applications that use API keysAn API key is a long-lived access token created using API key credentials. They are valid for up to one year and are typically embedded directly into client applications.Learn more or OAuth 2.0OAuth 2.0 is an industry standard protocol for authorization. It defines how to obtain and manage credentials for web, desktop, and mobile applications. It is supported by ArcGIS.Learn more with the free tier. Services outside free-tier limits require pay-as-you-goPay-as-you-go is a payment option in ArcGIS Location Platform that allows you to exceed the free usage tier and pay for additional location services and capabilities based on usage.Learn more.

Billing guidance

Below is a summary of expected billing behavior based on common deployment scenarios. For detailed information on billing, see the pricing documentation.

All location service transactions are charged in USD.

Production readiness checklist

Before release, confirm that you have:

• Selected the correct deployment type.
• Chosen an authentication method that matches your access requirements.
• Enabled pay-as-you-goPay-as-you-go is a payment option in ArcGIS Location Platform that allows you to exceed the free usage tier and pay for additional location services and capabilities based on usage.Learn more for production workloads.
• Verified expected usage against service limits and costs.
• Reviewed required attribution and data terms.

Compliance and attribution requirements

Basemap attribution

BasemapA basemap is the foundational layer and data that provides the overall visual and geographic context for a map or scene. It typically includes geographic features and labels for land, water, roads, buildings, cities, places, and administrative boundaries, but can also include raster data such as satellite and areal images.Learn more attribution is required when you use basemap data in mapping applications. Include provider credits to satisfy licensing terms and attribution requirements.

Basemap attribution is required when building and deploying mapping applications that use the Basemap Styles service.

Data terms and attribution

Data terms define how data can be used. Attribution requirements define how providers must be credited. Requirements depend on the data type and source. ArcGIS Location Platform provides access to Esri and third-party data through ArcGIS OnlineArcGIS Online is a GIS mapping, analytics, data hosting, and content management software as a service (SaaS) product. It includes applications, tools, APIs, and location services for users and developers. It is subscription-based and requires an ArcGIS Online account.Learn more, ArcGIS HubArcGIS Hub is a cloud-based platform for building data-driven websites that let organizations share content and collaborate with stakeholders.Learn more, and ArcGIS Living Atlas of the World.

Esri data

Esri data includes basemapsA basemap is the foundational layer and data that provides the overall visual and geographic context for a map or scene. It typically includes geographic features and labels for land, water, roads, buildings, cities, places, and administrative boundaries, but can also include raster data such as satellite and areal images.Learn more, reference layers, demographic data, and other contentContent is a collection of items in a portal that belong to a user, group, or organization.Learn more provided by Esri. When you use Esri data in your application, you need to review the applicable terms of use and provide attribution as required.

Terms of use for Esri data stored in ArcGIS Living Atlas of the World are defined on the item pageAn item page is a web page in ArcGIS Online or the developer dashboard used to access and manage the properties for an item and the content it references such as a web map, hosted layer, or file.Learn more for that data. In many cases, those terms reference the Esri Master Agreement. The item page also identifies data source providers in the Credits section.

Third-party data

Third-party data includes any data that is not provided by Esri, such as data from government agencies, non-profit organizations, or commercial providers. These data providers may host their own content and data in ArcGIS and make it available through ArcGIS Online, ArcGIS Hub, or ArcGIS Living Atlas of the World.

When you use third-party data in your application, you need to review the applicable terms of use and provide attribution as required by the data provider.

Before using third-party data in your application:

• Review the applicable terms of use
• Confirm whether attribution is required
• Follow any provider-specific requirements

Related topics