We have a client that is using short-lived tokens for their ArcGIS server and I'm trying to figure out the best way to get tokens to access their data.

Is there a way to retrieve already generated tokens from the ArcGIS server and reuse them or should I use generateToken and store the token locally in our database?

  • 1
    As per the Tour there should be only one question asked per question. – PolyGeo Jun 22 '17 at 21:34
  • 1
    Have you reviewed the documentation? – Vince Jun 22 '17 at 23:44
  • That documentation mentions absolutely nothing about getToken/generateToken. I know what the difference is between long-lived tokens and short-lived tokens. I need more info on getToken/generateToken and not tokens in general. – bdk0172 Jun 23 '17 at 14:06
  • @PolyGeo, there is no way to whittle this down to one question. It basically comes down to should I use getToken or generateToken and why? – bdk0172 Jun 23 '17 at 14:14
  • Your fifth question looks like a focussed one so if you have no other thoughts on how to focus your question just delete the others. – PolyGeo Jun 23 '17 at 22:24

Each token generated has an expiration. There's no way to reuse an expired token if that's what you want. Consider the security vulnerability that will be introduced if tokens could be reused. Storing the tokens isn't a good idea either. I see no limit on the number of tokens you can generate. Simply hit the endpoint each time you need a token and get a new one till it expires.


  • I was wondering if there was a way to retrieve a valid token and if one didn't exist, then generate one. What happens if user A generates a token and we store it in localStorage and then user B comes along and generates a new token. Are both tokens valid or does user B generating a token invalidate user A's token? – bdk0172 Jun 26 '17 at 18:51
  • If user A gets a token and User B shows up, a new token is generated and assigned to user B. The token gets bound to the client requesting it. so, each session is unique. Token for user A and B will both be valid if the expiration time for the first token (User A) hasn't passed.They will eventually expire. They don't last forever. If you have the web Adaptor, the tokens get logged in IIS logs (if logging is enabled). You can grab them there. – Don Jun 26 '17 at 20:29
  • Thanks for the help. I'm going to start coding this today so I'll let you know if I run into any issues. – bdk0172 Jun 28 '17 at 13:41
  • I know it's been a while, but one of our customers is doing something odd and am wondering if I need to change up our functionality. We are storing token and expiration in localStorage so we don't have to generate a new token every time. Apparently our customer likes to reboot their ArcGIS server a lot so those tokens that haven't expired from localStorage are now invalid on the server. It appears that esri-leaflet/leaflet/mapbox is not passing the invalid token error to the client so we have no way of capturing and handling. Any concerns with just generating a token every time? – bdk0172 Mar 9 '18 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.