We have a service on a secure server. It's available through a proxy; the service layers from the proxy can be added to an ArcGIS Online map and viewed, but not edited. It throws an error message saying they are not edittable because they are not available for arcgis.com. It's the same when I try to use the service directly - I get prompted for password, but I still can't edit.

Documentation seems to suggest trusting the service to bypass the proxy. However, all we have achieved yet was to avoid being prompted for password - however, there's no authentication working, so we can't get to the service neither. What are we missing?

The service supports CORS and allows our arcgis.com account (Access-Control-Allow-Origin: organization.maps.arcgis.com). After logging into the original server through REST API, I could add few features, so the REST endpoint is fully working.

EDIT: we use basic (HTTP Basic Auth or Web-Tier authentication), not token-based authentication. Sorry for not mentioning it in the beginning.

1 Answer 1


I have done this in the past, but I authenticated the secured service from our own server on the ArcGIS Online side. In my case, I just needed a single Feature Service to be used in an AGOL app. Not quite the same workflow, but it worked. Here are the steps I followed:

  1. From your "My Content" tab, click "Add Item". Choose "ArcGIS Server web service".
  2. Provide the URL to the secured service and enter your credentials. Choose the option to store the credentials with the item and do not prompt for authentication.
  3. Share the service with the public or whatever groups need to see it.

enter image description here

Once it has uploaded and shared, all requests to the service will start with http://utility.arcgis.com/usrsvcs/servers/. I believe this is acting as a proxy on AGOL to communicate with the secured service.

enter image description here

And it even shows as logged in at the REST endpoint on AGOL with the credentials you provided:

enter image description here

You should now be able to publicly consume and edit this in an AGOL app.

  • A canonical answer, +1. However, this applies to token-based authentication, isn't it? I didn't specify it right from the start, but we need the basic authentication, the server doesn't support tokens.
    – Pavel V.
    Jan 14, 2016 at 7:34
  • Yes, you are correct. I assumed you meant token-based authentication. I haven't done any testing with AGOL for basic auth/web-tier so unfortunately, I don't have any insight for that.
    – crmackey
    Jan 14, 2016 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.