I have a web map application that was written in HTML & JavaScript (using the ArcGIS JavaScript API). It desplays a few services that reside on an ArcGIS Server (10.2). It also has a custom legend that is created by requesting legend information directly from the ArcGIS REST Service using an ajax call.

It was recently decided that the application should be "locked down" and require a login in order to access it. We accomplished this by using the ArcGIS Server Manager to "lock" one of the services that the application consumes, and set a user/password to access it. The IdentityManager was also subsequently added to the application code. Now, when we navigate to the application, we are prompted for a username and password. After entering the correct credentials, access is provided and the "locked" layer successfully loads.

Unfortunately, the legend, which relies on an ajax call to the (now restricted) service endpoint, is not working. The ajax call returns error code 499 with the message "Token Required." I'm fairly new to ajax calls to begin with, and not at all familiar with service authentication and tokens. What is the correct way to pass the token with my ajax call in order to get the information I need to create my legend (and if I need to explicitely obtain the token, how do I do that?)

  • Good question. Can you elaborate on how the legend is created via the AJAX call? eg, what triggers the AJAX call? How does your application know which URLs to query - does it obtain the URLs from the map's layers, or from hard-coded paths? (This may or may not be related to the problem, but might help someone to arrive at a solution). Dec 3, 2014 at 5:07
  • The call is triggered during the creation of the Legend widget, after the layers are loaded to the map. The URLs for the calls are obtained by getting the URL of the layers passed to the widget, and modifying them appropriately to point to the JSON version if the legend on the ArcGIS REST Service.
    – Beck
    Dec 4, 2014 at 13:41
  • Does the information at resources.arcgis.com/en/help/main/10.1/index.html#/… help at all? Dec 7, 2014 at 22:20

2 Answers 2


The state of the IdentityManager can be retrieved using the toJson() method. That should give you the token to use with the ajax calls.


The following URL can be used for generating token via ajax.


Late post, but may help some one like me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.