Working alongside ArcGIS: read-only sign-in

When a stormwater program brings in new software, the GIS lead usually asks the same questions first. Whose account does it use? Can it change our layers? Where do our records end up? This post answers those questions for NPDESTracker’s ArcGIS connection in plain language, with the limits stated next to the capabilities.

A note on the relationship first. NPDESTracker is a Startup Partner in the Esri Partner Network. Esri’s partner directory lists Wood Technologies LLC, the company that develops NPDESTracker, as a Startup Partner, with NPDESTracker as its product. That is a membership. It is not a certification, an endorsement or a product review by Esri.

Two different things on your map

It helps to separate two things that look alike on screen.

• The basemap. This is the streets and imagery underneath your data. Depending on the map and the background chosen, your browser loads it directly from Esri (ArcGIS basemaps and imagery), OpenStreetMap or OpenTopoMap, and that provider receives the area of the map being viewed and your IP address. An Esri basemap is drawn with a credential NPDESTracker manages, so your staff do not each need an ArcGIS account just to see a map.
• Your agency’s own ArcGIS content. This is your storm drain network, your outfall and BMP layers, and your web maps. NPDESTracker reaches this content only through a connection that an individual staff member authorizes, under that person’s ArcGIS identity and permissions.

The basemap credential cannot open your private content, and each connection works under the ArcGIS identity and permissions of the person who made it.

How named-user sign-in works

Esri calls this user authentication: someone with an ArcGIS account signs in to an application, and the application receives an access token that lets it use services and content on that person’s behalf. What the token can reach depends on the person’s account type, roles and privileges, and the usual protocol is OAuth 2.0 (Esri’s introduction to user authentication).

In NPDESTracker, it looks like this:

• The person signs in at Esri. A staff member chooses to connect, is sent to Esri to sign in with their own ArcGIS account, and comes back to NPDESTracker.
• No passwords or shared keys. NPDESTracker never asks for, sees or stores an ArcGIS password, and your agency is never asked for an API key, a client secret or a shared service account.
• No new permissions. What a person can see through NPDESTracker is exactly what ArcGIS already allows their account to see. NPDESTracker cannot widen an ArcGIS permission.
• The long-lived credential stays on the server. The refresh credential is kept on NPDESTracker’s server and is never sent to the browser.
• Your administrator stays in control. Your ArcGIS organization administrator may need to approve NPDESTracker as an external application before the first connection completes. That approval is granted inside your own ArcGIS organization, and removing it, or disabling the account, ends what NPDESTracker can read.

Each connection is keyed to one person in one agency workspace, and identity is worked out on NPDESTracker’s server instead of being taken from the browser.

What read-only means

NPDESTracker reads maps, layers and features from your ArcGIS organization for display and for compliance context. It performs no writes of any kind against that content, and there is no setting that turns writes on.

• No feature edits, adds or deletes.
• No attachment or photo changes on your layers.
• No item administration, sharing changes or publishing.
• No web map saves. Your maps come back exactly as your GIS staff left them.

This is checked, not just described. An automated inventory of the mapping code and a runtime check must both report zero write calls, or a release does not ship.

Where each kind of record lives

• Your ArcGIS content stays in ArcGIS. Content read through the connection is read for display and context, not copied into NPDESTracker.
• Compliance records live in NPDESTracker. Records your team creates there, such as inspections, tasks, IDDE cases, markups, saved views and report evidence, are stored in your agency’s NPDESTracker workspace.
• Imported files are kept as you sent them. Files you choose to import, such as GeoJSON, shapefile or CSV, are stored in NPDESTracker, with the original file kept separately from the version prepared for the map.
• Field observations go to your GIS team for review. When an inspector spots something the GIS does not show yet, such as a catch basin that was never mapped, they draw it on a separate markup layer. The markup exports as GeoJSON so your GIS team can review it and merge it on their own schedule. NPDESTracker does not edit your authoritative data.

When something goes wrong

A failed read should never look like an empty map. If NPDESTracker cannot reach ArcGIS, cannot use a credential, or is not allowed to read a layer, it says which of those happened. A layer that is genuinely empty reads as empty; a failed read does not. That distinction matters to a coordinator, who would otherwise conclude from a blank map that a program has no outfalls.

What we do not claim

• Certification, audit, endorsement or product review by Esri.
• Two-way synchronization. NPDESTracker does not push records back into your ArcGIS layers.
• Feature Service editing of any kind.
• An ArcGIS Marketplace listing.
• A replacement for ArcGIS Online, ArcGIS Enterprise or QGIS. Your authoritative GIS work stays where it is.

A short checklist for your GIS lead

1. Find out whether your ArcGIS organization requires administrator approval for external applications, and who grants it.
2. Connect with an ordinary staff account, not an administrator account, and confirm NPDESTracker shows only what that account can see.
3. Confirm that the ArcGIS organization NPDESTracker shows is the one you expect.
4. Open a layer the account is not allowed to read, and check that the message says so instead of showing an empty map.
5. Disconnect inside NPDESTracker, remove the application approval in ArcGIS, and confirm that access ends.

The full technical page, written for GIS and IT reviewers, is ArcGIS integration and security. The GIS workspace page shows how sites, outfalls and BMPs sit on the map next to their records, and MS4 software vs ArcGIS covers why most programs end up using both tools.

Seeing it

The public demo’s Map runs on fictional data and is read only, so it shows how records sit on the map but not a connection to a real ArcGIS organization. The connected view runs on your own organization, so it is walked through with your team in a private demonstration. Questions from a GIS or IT reviewer can go to admin@npdestracker.com.

Sources checked October 17, 2026.