Hide the password in a Python script that connects to an ArcGIS Enterprise instance or ArcGIS Online using the GIS class and its constructor

Summary

It is common for Python scripts that use the ArcGIS API for Python to be run as scheduled tasks (notably using the Windows Task Scheduler) to perform various administration and content management tasks.

These scripts use the GIS class—via its constructor—to connect to an ArcGIS Enterprise instance or ArcGIS Online.

Example:

from arcgis.gis import GIS
gis = GIS(
        url="https://www.arcgis.com",
        username="UserName",
        password="Password"
    )
print(gis)
print(gis.users.me.username)

Output:

PS C:\Users\blaurancin> & "c:/Program Files/ArcGIS/Pro/bin/Python/envs/arcgispro-py3/python.exe" c:/Users/blaurancin/Desktop/gis.py
GIS @ https://d2esrifrance.maps.arcgis.com version:2026.1
blaurancin_support

Note:
The issue is that the password in the script is stored in clear text.

If a malicious person obtains the credentials (username/password) of the account used in the script, they can connect to the ArcGIS Enterprise or ArcGIS Online instance and perform malicious and/or unwanted operations—especially considering that the account used in this context often has an Administrator role.

Procedure

To avoid this, one option is to use the Storing your credentials locally method.

This method consists of creating persistent profiles to connect to an ArcGIS Enterprise or ArcGIS Online instance by providing credentials.

The profile stores the username, the profile name, and the URL of the ArcGIS Enterprise or ArcGIS Online instance in the user’s home directory (C:\Users\<UserName>), in an unencrypted configuration file named .arcgisprofile.

The profile securely stores the password in an operating-system–specific password manager using the Python keyring module.

Persistent profiles for the GIS can be created by giving the GIS authorization credentials and specifying a profile name.

The .arcgisprofile file is created as follows, the first time you connect using the profile parameter:

from arcgis.gis import GIS
gis = GIS(
        url="https://www.arcgis.com",
        username="UserName",
        password="Password",
        profile="agol_support"
    )
print(gis)

Here, the url, username, and password parameters are provided. We will no longer need to specify them once the profile has been created.

The file C:\Users\<UserName>\.arcgisprofile is created.

The .arcgisprofile file is a hidden file. The display of hidden items in Windows Explorer must be enabled:

Below is an example of the content of the .arcgisprofile file:

[agol_support]
date_modified = 2026-04-09 14:36:47.783060
url = https://www.arcgis.com
username = blaurancin_support

The password is stored in the Windows Credential Manager:

Control Panel\All Control Panel Items\Credential Manager

If you click the Edit button, the password is hidden:

from arcgis.gis import GIS
gis = GIS(profile="agol_support")
print(gis)

Output:

Python 3.13.7 | packaged by Anaconda, Inc. | (main, Sep 11 2025, 16:13:29) [MSC v.1938 64 bit (AMD64)] on win32
Enter "help" below or click "Help" above for more information.

================= RESTART: C:\Users\blaurancin\Desktop\myGIS.py ================
GIS @ https://d2esrifrance.maps.arcgis.com version:2026.1

There is no need to specify the url, username, and password parameters.

The url and username parameters are retrieved from the .arcgisprofile file, and the password is retrieved from the Windows Credential Manager.

It is possible to create multiple profiles, as follows:

from arcgis.gis import GIS
gis115 = GIS(url="https://ad-p-age115.westus2.cloudapp.azure.com/portal", username="UserName", password="Password", profile="myGIS115")
gis1091 = GIS(url="https://supad-p-age1091.westus2.cloudapp.azure.com/portal", username="UserName", password="Password", profile="myGIS1091")
print(gis115)
print(gis1091)

The file C:\Users\<UserName>\.arcgisprofile is updated if it already exists; otherwise, it is created:

[agol_support]
date_modified = 2026-04-09 14:36:47.783060
url = https://www.arcgis.com
username = blaurancin_support

[myGIS115]
date_modified = 2026-04-09 16:39:50.018119
url = https://ad-p-age115.westus2.cloudapp.azure.com/portal
username = blaurancin

[myGIS1091]
date_modified = 2026-04-09 16:39:52.173946
url = https://supad-p-age1091.westus2.cloudapp.azure.com/portal
username = blaurancin

Example:

from arcgis.gis import GIS
myAgol = GIS(profile="agol_support")
gis115 = GIS(profile="myGIS115")
gis1091 = GIS(profile="myGIS1091")
print(myAgol)
print(gis115)
print(gis1091)

Output

GIS @ https://d2esrifrance.maps.arcgis.com version:2026.1
GIS @ https://ad-p-age115.westus2.cloudapp.azure.com/portal version:2025.1
GIS @ https://supad-p-age1091.westus2.cloudapp.azure.com/portal version:9.2

This is also very convenient if the ArcGIS API for Python is frequently used.