499 Token Required or Client Closed Request

HTTP response status code 499 is an unofficial client error specific to both ArcGIS (as 499 Token Required) and nginx (as 499 Client Closed Request).

Usage specific to ArcGIS

The 499 Token Required status code indicates the server expects an Authentication token with the HTTP request, but none was submitted. Resolving this error requires resubmitting the request with a valid token.

Usage specific to nginx

The 499 Client Closed Request status code means the client closed the HTTP connection before the server finished processing. The final response never reaches the client. This code appears only in the nginx logs.

Common causes include client-side timeouts, users navigating away, and load balancers closing idle connections.

Examples

ArcGIS Token Required

A client sends a request to an ArcGIS REST API endpoint without the required token. The server responds with 499 Token Required.

Request

GET /arcgis/rest/services/Map/MapServer?f=json HTTP/1.1
Host: www.example.re

Response

HTTP/1.1 499 Token Required
Content-Type: application/json

{
  "error": {
    "code": 499,
    "message": "Token required.",
    "details": []
  }
}

nginx Client Closed Request

A client sends a long-running request but disconnects before the server responds. The nginx access log records the 499 status code.

Request

GET /api/heavy-report HTTP/1.1
Host: www.example.re

Response (nginx log entry only)

192.168.1.50 - - [02/Mar/2026:14:22:10 +0000] "GET /api/heavy-report HTTP/1.1" 499 0 "-" "python-requests/2.31.0"

No HTTP response is sent. The client disconnected before the server completed processing.

How to fix

nginx Client Closed Request

Identify slow upstream targets first. Add $upstream_response_time and $upstream_connect_time to the nginx log format to measure backend latency:

log_format timed '$remote_addr $status '
  '$upstream_response_time '
  '$upstream_connect_time '
  '$request_uri';

Enable proxy_ignore_client_abort for endpoints where the backend operation must complete even after the client disconnects. This prevents nginx from terminating the upstream request when the client drops the connection:

location /api/long-task {
    proxy_ignore_client_abort on;
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
}

Increase proxy timeouts to match the expected backend processing time. The three relevant directives are proxy_connect_timeout (time to establish the upstream connection), proxy_read_timeout (time between two successive read operations from upstream), and proxy_send_timeout (time between two successive write operations to upstream).

Reduce backend response time. Slow database queries, unoptimized API endpoints, and resource contention on the upstream server are the root cause in most 499 cases. Profile and optimize the slow endpoints rather than increasing timeouts indefinitely.

Review the nginx access log for patterns. Filter for 499 entries and correlate by request URI, time of day, and response size to identify specific endpoints or traffic spikes triggering client disconnections.

For load balancer or CDN clients upstream of nginx, ensure the load balancer idle timeout exceeds the nginx proxy timeout. A load balancer closing the connection before nginx receives the upstream response produces 499.

ArcGIS Token Required

Include a valid Authentication token in the request. The ArcGIS server expects a token and rejects requests without one.

Generate a token using the generateToken REST endpoint and attach the value as a query parameter (?token=...) or in the X-Esri-Authorization header:

X-Esri-Authorization: Bearer <token>

The X-Esri-Authorization header is preferred over the query parameter. Query parameters appear in server logs and intermediate proxy logs, exposing the token.

Verify the secured service requires token-based Authentication. Services configured for anonymous access do not require a token. Check the service security settings in ArcGIS Server Manager or the ArcGIS Portal admin interface.

Takeaway

The 499 Token Required / Client Closed Request status code is specific to ArcGIS, where the request required a missing Authentication token, and nginx, where the client closed the connection before receiving a response.

See also

• 498
• Google: HTTP status codes and network errors
• ArcGIS Survey123
• Esri Technical Support for ArcGIS error 499
• HTTP status codes