498 Invalid Token

The 498 Invalid Token code is an ArcGIS-specific error from Esri, reported when the Authentication token in the request is expired, revoked, or otherwise invalid. The value travels inside the JSON body of a 200 response rather than on the status line.

Table of Contents

Usage

The 498 Invalid Token status code indicates the client included a required Authentication token in the HTTP request, but the server rejected the token. Common causes include expired tokens, revoked tokens, and tokens generated for a different service endpoint. Resolving this error requires resubmitting the request with a freshly generated, valid token.

The distinction between an application code and a status code matters for anyone writing a client. ArcGIS answers with 200 and places 498 in the error object, so code branching on the HTTP status alone treats the response as a success and continues with an error document in hand. Detecting the condition means parsing the body.

Esri's own JavaScript client follows the same split, checking the HTTP status first and inspecting the body separately for 498 and 499 before raising an authentication error.

Example

A client sends a request to an ArcGIS REST API endpoint with an expired token. The server responds with 498 Invalid Token.

Request

GET /arcgis/rest/services/Map/MapServer?f=json&token=expired_abc123 HTTP/1.1
Host: www.example.re

Response

HTTP/1.1 200 OK
Content-Type: application/json

{
  "error": {
    "code": 498,
    "message": "Invalid token.",
    "details": [
      "Token has expired."
    ]
  }
}

The status line reports success. Only the code field inside the error object identifies the failure.

How to fix

Generate a new Authentication token from the ArcGIS token endpoint. Expired tokens are the most common cause of this error. The generateToken REST operation issues a fresh token:

POST https://www.example.re/portal/sharing/rest/generateToken
Content-Type: application/x-www-form-urlencoded

username=admin&password=secret&client=referer&referer=https://www.example.re&f=json

The Content-Type header must be application/x-www-form-urlencoded. Missing this header causes token generation to fail silently.

Check token binding settings. Tokens bound to a specific IP address fail when a proxy, load balancer, or NAT changes the apparent client IP between token generation and use. Switch to client=referer binding when proxy infrastructure sits between the client and the server.

Verify the username is case-sensitive. The ArcGIS REST API treats Admin and admin as different accounts during token generation.

Check the token expiration timestamp returned in the generateToken response and refresh before expiry. Implement proactive token renewal in client code to avoid mid-request expiration.

Send the token in the X-Esri-Authorization header instead of the token query parameter. Query parameters are logged by intermediate proxies, gateways, and load balancers, exposing the token in plain text:

X-Esri-Authorization: Bearer <token>

Confirm the token has permissions for the requested resource. Tokens generated for one ArcGIS Server endpoint or organization are not valid for a different endpoint. Federated servers require a portal token exchanged through the federation trust relationship.

See also

Last updated: August 17, 2026