Short-lived token security
Short-lived tokens must be requested from the ArcGIS token service. To use short-lived token security, a catalog service must be specified, along with values for the tokentimeout (minutes), user (user ID), and pw (password) attributes.
For example:
<CONFIG
catalogservice="http://Server/ArcGIS/services”
mapservice="http://SampleServer/ArcGIS/services/Geometry/GeometryServer"
geometryservice="http://SampleServer/ArcGIS/services/Geometry/GeometryServer"
user="arcgis" pw="lAY1635Ers" tokentimeout="60">
</CONFIG>