Search

Web Connections and FME

Liz Sanderson
Liz Sanderson
  • Updated

Web Connections are a convenient and secure way to store web service credentials in FME for reuse. Web connections can be shared from FME Form to FME Flow. 

FME can connect to many different services, including Esri ArcGIS products (ArcGIS Online, ArcGIS Enterprise, and ArcGIS Portal), Google Services (Google Drive, Gmail, BigQuery, etc.), and many more. You can also download additional ones from the FME Hub. 

This article will cover Configuring and Creating Web Services in FME, as well as the three authorization protocols we support for creating web connections:

A web service and web connection are different objects in FME:

Web Service

A Web Service definition contains all the information the FME needs to connect to that service and how that service expects to authorize FME. We support a few authorization protocols: OAuth 2.0, Token, and HTTP Authentication.

Web Connection

The Web Connection is where you enter user credentials to connect to a web service, as specified in the web service definition. Once a web service is defined in FME, many web connections can be created from it.

A web service cannot be used on its own to access target resources; it must be referenced via a web connection. Many web connections can be created from a single web service.

Configuring and Creating Web Services in FME

Many web connections in FME work out of the box. This means that when you’re using a particular Connector transformer for your web service, or the HTTPCaller, you can create your web connection without editing the web service definition. This is because Safe Software has already registered applications with those web services, and for OAuth 2.0, we use Safe’s Client ID and Client Secret. 

The web connections created by Safe are for testing purposes only. Please make a copy of the web service and edit the Client ID and Client Secret with your own values. This will ensure the service continues to work properly for you in your production environment.

If you’re beginning to author your workspace and testing it, the ‘out of the box’ connections are great to use. However, if you’re authoring a workflow that will be used repeatedly or in production workflows, we recommend registering your own application with the web service. This is because Safe’s authorization credentials could be revoked or subject to service outages at any time, affecting users who haven’t registered their own applications with the web service. If you plan to use the web connection on FME Flow, you must register your own application, or the web connection will stop working after a brief period.

Web Connections and Web Services are managed from Utilities > FME Options (Tools > FME Options in FME 2025.0).

Learn more about each of the authorization protocols we support:

OAuth 2.0

OAuth 2.0 is an authorization protocol that allows an application to act on behalf of a user. This is done using an access token. Depending on the web service used, a user will typically need to authenticate with that service to obtain an access token (behind the scenes). The client application, in this case FME, will use that access token going forward to connect to the web service. Access tokens are short-lived: when an access token expires, the client application uses a second token, the refresh token, to obtain a new one.

For more detailed information on OAuth 2.0, see oauth2.net. This article intends to explain OAuth 2.0 in the context of FME Web Connections and is not intended to fully explain how OAuth 2.0 works.

Refer to your web service provider's documentation when configuring an OAuth 2.0 web service in FME.
You will need the following:

1 Client ID 

Public identifier for your registered application

2 Client Secret

Secret string (like a password) that is only known to your application and the authorization server

3 Redirect URI 

This is where the service will redirect the user after the user has authorized the application. This must be the same in the web service definition as in the registered application. If your web service doesn’t provide one, you can typically use https://localhost/ for FME Form and https://<public FME Flow address>/fmeoauth for FME Flow. ArcGIS Online and some other services may allow you to use the string urn:ietf:wg:oauth:2.0:oob, which tells the service to redirect back to the application that made the call. Always refer to your web service's documentation.

4 Authorization URL

The authorization URL, or endpoint, directs you to the right location to authorize. This URL or endpoint will contain a scope. If you’re registering your own application with a web service, you will need to make sure the correct scope is specified. The scope determines what permissions or access the application will have to that web service.

5 Retrieve Token URL

URL used by the application to obtain an access token

6 Refresh Token URL

URL used by the application to refresh the access token

Please see Creating an OAuth 2.0 Web Service Connection in FME for more detailed instructions. 

Token

Token authorization is used in place of a username and password. You will normally either obtain a token when registering an application with your web service, or pass your username and password so the application can generate its own token.

The token may need to be granted specific permissions to authorize access to the web service. 

The token should be protected and not made publicly available. It's recommended to store it in a password or Secrets Manager.

There is also an OAuth 2.0 Client Credentials grant type that follows the same flow as a Token Web Service. If your web service provider uses the OAuth 2.0 Client Credentials grant type, create a token web service instead of an OAuth 2.0 web service in FME.  

Refer to your web service provider's documentation when configuring a token web service in FME.
You will need the following:

1 Access Token Request

This Request URL and Request Data (parameters) will be used by FME to request an access token.

2 Access Token Response

Key names returned by the Request URL that identify the token and expiry time

3 API Call Parameters

Once FME receives an access token, the API Call Parameters specify how to use it when authenticating with the web service. The web service may expect the token to be provided in the HTTP header, the query string, or both. The web service will also expect the HTTP header or query string to be formatted a certain way. Consult your web service provider's documentation.

The article Creating a Token-based Web Service in FME - Yelp provides an example of setting up a Token.

HTTP

HTTP Authentication is a simple technique for accessing web services in which the user provides only a username and password. This is often referred to as basic authentication.

This would likely be used in the HTTPCaller or OpenAPICaller transformers, where the entered URL requires a username and password to access a web service or API.

Additional Resources

Esri ArcGIS Connections

AWS Connections

Microsoft Connections

Google Connections

Troubleshooting

Was this article helpful?

We're sorry to hear that.

Please tell us why.

As of January 14th, 2026, comments on knowledge base articles have been closed. To make sure questions don’t get missed and to enable more community support, we’ve moved discussions to the FME Community. If you have a question or a comment about this article, please create a new post or create a support ticket.